a8a4b1be4a0ba2b0f5cc7d4342fbbe02_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a8a4b1be4a0ba2b0f5cc7d4342fbbe02_JaffaCakes118
Size

92KB
MD5

a8a4b1be4a0ba2b0f5cc7d4342fbbe02
SHA1

672924039f14a49105334d599f0a3d3cd108616a
SHA256

f5983111cf52b7ff4cd4b7f9bed6490c397edd1175e30f00c6bf685bb5a4b9ff
SHA512

c07cca03d8120038e4e8c2c8bb75c61bc9ae94048eb47242c511c05e93d380cdaedf8a8fa090670da0bc53aa8b0cb6ddf1a0d12a94e9e7918ce75976c4af1051
SSDEEP

1536:YzyHGU/PJFyIO0McdfKUtWCxt257YHdbb3Dbofb+nkBNIi80+lhqjtTQzf/:WyHL/PXdTdfKU5DgY9wjBNIbblkpcD/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8a4b1be4a0ba2b0f5cc7d4342fbbe02_JaffaCakes118

Files

a8a4b1be4a0ba2b0f5cc7d4342fbbe02_JaffaCakes118
.exe windows:4 windows x86 arch:x86

97bc4c03b63d15e309e79c1fc0fa3db8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

send

msvcrt

exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
_exit
rand
strtok
atoi
free
sprintf
malloc
fopen
fclose
_adjust_fdiv
_controlfp

kernel32

GetModuleFileNameA
GetCommandLineA
CreateFileA
WriteFile
CloseHandle
OutputDebugStringA
Sleep
GetProcAddress
GetModuleHandleA
GetStartupInfoA
DeleteFileA

user32

MessageBoxA

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA

ole32

CoCreateInstance
CoInitialize

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ