94dffa221caba08e2e8abf5272f0765a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

94dffa221caba08e2e8abf5272f0765a_JaffaCakes118
Size

850KB
MD5

94dffa221caba08e2e8abf5272f0765a
SHA1

68206bad8afe3c83f2ce6fc29e395f075e5ae99d
SHA256

c54aaff59f300c8b1d2cd8d2eca60c6980581e12e042a51182e04b37ff56877f
SHA512

106af09f248c65eca3a42e56b40712d413727952b735c09db5e1f2dea2a8bd6305429a7565d39a9364dcd774d940950821ccfa2eda836a57d206460630f525d0
SSDEEP

12288:9p0MA9d1Tyqhnbs8oape+YrBzZd4Wnr5KqpupYV0lq1013S70KD973WTsg2fAA+T:5A9HT1hnbs8oxVmc5tJrOSkTsgFXYU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94dffa221caba08e2e8abf5272f0765a_JaffaCakes118

Files

94dffa221caba08e2e8abf5272f0765a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

151f5dfb952bae6a34782fc1ba82f3b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetModuleHandleA
GetCommandLineA
CreateProcessA

shell32

SHGetSpecialFolderPathA

mfc42

ord1575
ord353
ord3318
ord823
ord561
ord815
ord665
ord800
ord1979
ord6385
ord5186
ord941
ord537
ord354
ord5442

msvcrt

__CxxFrameHandler
__dllonexit
_onexit
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

msvcp60

??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ