8db5a24707d59eafe128102226e50146_JaffaCakes118 | Triage

Sharing

General

Target

8db5a24707d59eafe128102226e50146_JaffaCakes118
Size

9KB
MD5

8db5a24707d59eafe128102226e50146
SHA1

c4f12b326479f13d16d913fd90f757c2f2b96e5d
SHA256

dbfb73b28918302dd5d51cc86462eda7c7c5298a2415c6c4f5050b6928836c73
SHA512

696b27ec02bab292679407fddeb71edd406239714dba7b5ca7715ac4b33bbb56663b61a6c891329c4141ccfd7a29521cc43e8e6320f333bcbf50a69f00595632
SSDEEP

192:prNNE+wLH6GgtUYl8R+b+nGl+t/xrW6Rr55JevN7aeuoQzAxEndh1n:HNM6GuqqIGlcNING3oWAGh1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/elitewrap.exe

Files

8db5a24707d59eafe128102226e50146_JaffaCakes118
.zip
elitewrap.exe
.exe windows:1 windows x86 arch:x86

dcf071295ab45e42e14d13874643dc97

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetModuleHandleA
RtlUnwind

crtdll

_iob
__GetMainArgs
_strlwr
exit
fclose
fgets
fopen
fprintf
fread
fscanf
fseek
ftell
fwrite
gets
printf
raise
remove
scanf
signal
strlen

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 88B - Virtual size: 88B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 710B - Virtual size: 710B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 924B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
readme.txt
test1.ews