a13be5e64debda686a2176088a9ba940_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a13be5e64debda686a2176088a9ba940_JaffaCakes118
Size

82KB
MD5

a13be5e64debda686a2176088a9ba940
SHA1

473c8295ffadcbb08cec56c3991782d87737038d
SHA256

b638b2a2543040254178245cb4aab4f6003d8c9e73bac32d449c32967c9a5696
SHA512

03ce72ab9ad0ad6184ce980058a696a6b3a6cc0f348269a0b3372191795641b6de67505419bf9031c243ea54f99ad9ee6801fd1e57b84666b0a2ee2218c030b7
SSDEEP

1536:iqBSYIPx4yqxZGTvj/TgHjJa8bMndny203hQd7O/AEw4pTF6t:nuPYxgTvzMDo8odnyBQdSw4pTF6t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a13be5e64debda686a2176088a9ba940_JaffaCakes118

Files

a13be5e64debda686a2176088a9ba940_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a70834f9dbc0472dd805e6e58ae3b43b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
CreateFileA
GetTickCount
WriteFile
lstrcatA
GetProcAddress
GetTempFileNameA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetCurrentProcessId
GetTempPathA
lstrlenA
CreateRemoteThread
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
VirtualAllocEx
LoadLibraryA
WriteProcessMemory
FindResourceA
LoadResource
GlobalAlloc
SizeofResource
GlobalFree
LockResource

user32

wsprintfA

shell32

ShellExecuteA

msvcrt

memcpy
memset

Sections

.text
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ