a04e4deaf842159f343f74f18d656765_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a04e4deaf842159f343f74f18d656765_JaffaCakes118
Size

44KB
MD5

a04e4deaf842159f343f74f18d656765
SHA1

c141e7e88f45324de94a852bd95b27e5a34f3ba7
SHA256

44ba0f62fda482bdedce34a3ad85a48bd089bf3d9e5c880bd9375bce2e1129b7
SHA512

8f90a79865c5743e5ba5e325ac3b22ecba8e3f80e52de7e994d4ba08200aecd3a3b4ab595881082144b04631fb410e93bef881f953fc8b54210bf899c97d088c
SSDEEP

768:xKlW54459n6/wGTVmhiZXoiL9i3TJwusiwmCtyODG:UlA44Dn6oGZmWocmx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a04e4deaf842159f343f74f18d656765_JaffaCakes118

Files

a04e4deaf842159f343f74f18d656765_JaffaCakes118
.exe windows:4 windows x86 arch:x86

62a60aac7172ebab5a6b7a6368e1a814

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleA
WriteProcessMemory
lstrlenA
VirtualFreeEx
LoadLibraryA
VirtualFree
VirtualAllocEx
VirtualAlloc
GlobalFree
SetThreadContext
GetThreadContext
ResumeThread
GetModuleFileNameA
GetStringTypeA
LCMapStringW
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
GetStringTypeW

user32

wsprintfA

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE