a502e3d2a8048558fbfa4dcb4875744a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a502e3d2a8048558fbfa4dcb4875744a_JaffaCakes118
Size

168KB
MD5

a502e3d2a8048558fbfa4dcb4875744a
SHA1

6b3cf853d96a6ae0b871bca86c5be8381c0c69e9
SHA256

2f5917260aba9d098e9dd0e7fea4da7c737bf4c970c53e243b0c899aa4c8170c
SHA512

9bde6ab55d5b2674ac7f16acd6ebc21718722605f7144692ecda1342391629b02d1cbfee3eb869b5a55f5d19d88a187ed273ab6ec0a257f3c32bc9bcd920a26f
SSDEEP

3072:y0Kb5MlAgcDKpFBTOWufwUCxCRbO2dgk06FUHavcV:yf5MGgxFBTOW9UWqkV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a502e3d2a8048558fbfa4dcb4875744a_JaffaCakes118

Files

a502e3d2a8048558fbfa4dcb4875744a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE