a17250b0bc85d35547f8209adbad6428_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a17250b0bc85d35547f8209adbad6428_JaffaCakes118
Size

3KB
MD5

a17250b0bc85d35547f8209adbad6428
SHA1

d26c3e19162b7cf8eb03805a0843fb3452f406ca
SHA256

0ff59a69d47c9b1db0addb6d40330bb4ae371d30387cca31d42b2c6ce10a2a25
SHA512

77630e12b47eb644eef628c28ed7a09a5475a8f764c9dd98a9559313ea4f70f2256343f44dc47d168c7e7d01887e56f82b9500c52957f592e08dd5e2d0860db2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/spasmpwd.exe

Files

a17250b0bc85d35547f8209adbad6428_JaffaCakes118
.zip
spasmpwd.c
spasmpwd.exe
.exe windows:4 windows x86 arch:x86

3cbad9ff26396a291be358cef85b9ac2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

ExitProcess
SetUnhandledExceptionFilter

msvcrt

_strnicmp
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
atexit
exit
fclose
fgetc
fgets
fopen
fputs
fwrite
perror
printf
puts
setbuf
signal
tolower

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 128B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE