971d38f0abac529d39e3a5981cdad816_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

971d38f0abac529d39e3a5981cdad816_JaffaCakes118
Size

166KB
MD5

971d38f0abac529d39e3a5981cdad816
SHA1

29741d4b9c3628fc139185fbe3120db0c8e2dd81
SHA256

d490511360d846a2c129f852d197a5b774652557b5deeeafb05750a7abbb840c
SHA512

ed4d7319d39cfbaaa47531cbe8517ecb5262eac31c9ad2422dac4122f059ea72c8b436e853ba2ba91ab8e9278afabfc97192dc4c7a46c66b6c7937f1257c6879
SSDEEP

3072:htZ1sip77Hpp651YFKJ4sp1csbo/4oxYC6lRdkDg89JdtZa:hjtJbFKGsp1cF/4vNPdkDg8NtM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
971d38f0abac529d39e3a5981cdad816_JaffaCakes118

Files

971d38f0abac529d39e3a5981cdad816_JaffaCakes118
.exe windows:1 windows x86 arch:x86

a6addd5a930d012c3ce7bbd887c6c718

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
TerminateProcess
GetStartupInfoA
GlobalMemoryStatus
lstrcpyA
LCMapStringW
FindResourceA
HeapAlloc
HeapCreate
ReadFile
GetThreadContext
GetComputerNameW
FindFirstFileA
GetModuleHandleA

msvcrt

_adj_fdivr_m32i
__p__fmode
_wfullpath
__getmainargs
_controlfp
_initterm
exit
_wcstoui64
iswascii
_exit
_wremove
_adjust_fdiv
_endthreadex
memcpy
__p__commode
_unlock
_XcptFilter
tmpfile
_acmdln
wcscspn
_mbstrlen
_except_handler3
_mbschr
__setusermatherr
__set_app_type
_mbslwr

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ