a246c80e4ce704db67c361452bf3145d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a246c80e4ce704db67c361452bf3145d_JaffaCakes118
Size

168KB
MD5

a246c80e4ce704db67c361452bf3145d
SHA1

fc9ff9ba2c06bdc9e84f5455f25a84a8d1f9d518
SHA256

d9b0d138ac9f1cabcf5aa267645efec40c53ec8ba19025cdfc801f8f4d805062
SHA512

6e9c35e2fb1674965a4a7e6789afaae7d9e841c8f1edfc0b1e30dae3e9fe8bcbee7313bf725ab4aec249e0c3c50af8c9e83b349a4a847f8ab7f684cf5aa77ac9
SSDEEP

3072:xfP9ZGFwgvRLLCzOYFDq+UdnIPPlMzcsofIw+KaX0LcHLkMIIRc/:596wgvRHCzOYtqlGyzcsX3KA0LQIQRY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a246c80e4ce704db67c361452bf3145d_JaffaCakes118

Files

a246c80e4ce704db67c361452bf3145d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

53506080a826e6483487f80d272026ce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
VirtualAlloc
VirtualProtect
VirtualFree
GetProcAddress
LoadLibraryA
IsBadReadPtr
FreeLibrary
WinExec
OutputDebugStringA
GetModuleFileNameA
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
GetStartupInfoA
GetModuleHandleA

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_acmdln
exit
_XcptFilter
_exit
free
realloc
__getmainargs
_stricmp

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1014B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 152KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ