94c39a2a87eea41af0d318e81a9afa1e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

94c39a2a87eea41af0d318e81a9afa1e_JaffaCakes118
Size

25KB
MD5

94c39a2a87eea41af0d318e81a9afa1e
SHA1

d7b0e21824d404e61ec64d661d95165771011ff8
SHA256

46ccfd1b0705b4c48785fd38442d9869b51b61b03e8a6698267949f069c57623
SHA512

7effc3ec2f289fec315854bab17bff61f9ecf59030d379d679e306693f28ec877b551f7abc44e24a06f84e981df0563cb2a3d5ddfe4c130282c82d2084df7a91
SSDEEP

768:BgbgV2Y6+6ShRq/88D0kPEnPMqXOlHmRX0:BcgV2mf2/80tPaXXYHQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94c39a2a87eea41af0d318e81a9afa1e_JaffaCakes118

Files

94c39a2a87eea41af0d318e81a9afa1e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3e0ab94a78d82feef352a277fc763dd4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

wsprintfA

shell32

CommandLineToArgvW

msvcrt

rand

shlwapi

PathFileExistsA

ws2_32

WSAGetLastError

comctl32

ord14

Sections

.bss
Size: - Virtual size: 424B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dak
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE