a03f6ca4b3faf677950a5b09958d1fe3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a03f6ca4b3faf677950a5b09958d1fe3_JaffaCakes118
Size

227KB
MD5

a03f6ca4b3faf677950a5b09958d1fe3
SHA1

068fef1c3ad1bb406d7d04cb1792950a78991990
SHA256

3c62fda7a335ca88195a77ddc3f2b0522a7df30766422ca77bddc13980e63e29
SHA512

e67f6ec3d7ebfa9e57f3feb3b7330160bc67971f64f9c425b9b3daf455e66fdb9d27e7f68482fd31616511de5cab2d33dce94d66d40c3a5c19f4a3805c27688e
SSDEEP

3072:SmnmTZFq+kzEIKNcbuzFdIRue+/lZ9HUK/4VnqZcBzN8r:RmTeDgIuzyueM/VUK/4VGcBOr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a03f6ca4b3faf677950a5b09958d1fe3_JaffaCakes118

Files

a03f6ca4b3faf677950a5b09958d1fe3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hrdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE