a2057baab35ac0844f3ebdc373c9b67f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a2057baab35ac0844f3ebdc373c9b67f_JaffaCakes118
Size

312KB
MD5

a2057baab35ac0844f3ebdc373c9b67f
SHA1

a45a8e849f15a4e1d8c973e157869b29bed0f43c
SHA256

b2c7a17659d664b47596dd667e3ba456e39ad05fbaae84e08607f17f23216cef
SHA512

9d088c9e9bde3831388def02e70338f56125886ce4f132dea9777e18c37ffba66bd593b7f3779ac448e312631f640b2d42cef9afa90df9ca35c80d78f8c9a1b8
SSDEEP

6144:BWlTvMIor27eYO0tarC6nSOulm1B8IYZeSsI/rABvc:EzL7aVnSJm1tYZ9sUrABU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2057baab35ac0844f3ebdc373c9b67f_JaffaCakes118

Files

a2057baab35ac0844f3ebdc373c9b67f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

150223abab8870e7873e5737f43c23ad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
VirtualProtect
GetTempFileNameW
GetWindowsDirectoryW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetVersionExW
GetPrivateProfileStringW
GetSystemDirectoryW
DeleteFileW
RaiseException
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleA
GetStartupInfoA

msvcrt

_initterm
wcslen
_adjust_fdiv
wcscpy
free
wcstoul
_amsg_exit
memset
_exit
_XcptFilter
exit
_acmdln
__getmainargs
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
malloc

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 288KB - Virtual size: 570KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ