a47f3a62378c0bc0300558e372d10d8b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a47f3a62378c0bc0300558e372d10d8b_JaffaCakes118
Size

24KB
MD5

a47f3a62378c0bc0300558e372d10d8b
SHA1

306db92702e3038004eec446fedb2641df1fcaf5
SHA256

1925abcd3f2f4ee7b8afb08eaaf16a16dba1cba2159542f5e66be53a2882e42b
SHA512

3ea02d1d55240f501f8503c0e0d7f9c1670f9a4b05953aadc37731377972cfc208e2ea28378fe9a247449ead680187e5df2d6c511e4e09d51422786f5266d225
SSDEEP

384:NQDIyrozgbfs5cQD32Ee5cASjO51sdVM:NQDIkekf2Dm/CHjI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a47f3a62378c0bc0300558e372d10d8b_JaffaCakes118

Files

a47f3a62378c0bc0300558e372d10d8b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c7068f5e298febd29f14511465cda046

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetLongPathNameA
GetTempPathA
FreeLibrary
Sleep
MoveFileA
DeleteFileA
CloseHandle
WriteFile
CreateFileA
GetModuleFileNameA
CreateProcessA
GetModuleHandleA
GetStartupInfoA

msvcrt

isspace
ispunct
isprint
islower
isgraph
isdigit
isalpha
isalnum
div
ceil
isupper
strstr
??2@YAPAXI@Z
atol
_except_handler3
_access
sprintf
rand
srand
time
__CxxFrameHandler
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
isxdigit
??3@YAXPAX@Z
_itoa

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ