948ccaa0332971a99be004f40d2899ba_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

948ccaa0332971a99be004f40d2899ba_JaffaCakes118
Size

6KB
MD5

948ccaa0332971a99be004f40d2899ba
SHA1

7dac2b73219b591d7b150f117656a652cedd4bee
SHA256

1517e82e6a8db2840480a38eb675f2f6787c9fbbd050f79af3cb665c5c96a2d9
SHA512

b5a897a746c430b4000947cc11834ec38dd12da6834ad2585f72905936dfac64458a8ac4ced0118fde98e6525e1c78f102a0867b77ffa2d19f668f66a8f2cc7f
SSDEEP

96:gZ0uvMTGWGOz+V0sSRmSzFYjiUo8sC9qCu0iG650mFxRhByLndF:s00DOQ0srPjg8sC0H0iB50C7B6dF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
948ccaa0332971a99be004f40d2899ba_JaffaCakes118

Files

948ccaa0332971a99be004f40d2899ba_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3b845a3742545f49fac7daa0fa27085f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
CreateProcessA
ExitProcess
FindAtomA
GetAtomNameA
GetModuleHandleA
GetProcAddress
GetThreadContext
ResumeThread
SetThreadContext
SetUnhandledExceptionFilter
VirtualProtect
VirtualProtectEx
VirtualQuery
WriteProcessMemory

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
fclose
fopen
free
fscanf
malloc
memcpy
signal

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 112B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE