972f1dc46c6fc8e0859245c03bd55a10_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

972f1dc46c6fc8e0859245c03bd55a10_JaffaCakes118
Size

178KB
MD5

972f1dc46c6fc8e0859245c03bd55a10
SHA1

1d5f55396a9b4e6a04ada242de8b7ab9453aea01
SHA256

441f148fe1ce36d1ef6e5b1033cd78444ef123de3d75cab88941acabfd883545
SHA512

d6f50a505c612c6d5d071aad66a9f96e94dcb21e3a37d6aa062b6835612d65ed488dd3f589da9628379293442c82f60f81f76853d36f61bfa4f7cdfe1ba643ff
SSDEEP

3072:mdRoLvZXInc9YXHwLYLQKORq7ikZ7tXlwDJIAwG930gMG38C:mdebdInXH3ORq1wlIALEgMG38C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
972f1dc46c6fc8e0859245c03bd55a10_JaffaCakes118

Files

972f1dc46c6fc8e0859245c03bd55a10_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ikvcyaj
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE