a77b485f926b6ac9ac69201deebfdd02_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a77b485f926b6ac9ac69201deebfdd02_JaffaCakes118
Size

190KB
MD5

a77b485f926b6ac9ac69201deebfdd02
SHA1

0abdb651fd733ef6a657a7fdc5610cb00ea54cee
SHA256

eda1bd4e16b59c236993c67f1b5a2c76cc0ee31238b9924dd8d2bd1d05277f97
SHA512

12c6d28aceb4b8f83f789b6f1514b44a846026612fee0b65af4cfe2b7fea2d60ef61b4d56657507c82d6e85d664e18bf02eb0fc2eb4274241a1e7b257ef33bde
SSDEEP

3072:QuuDdu1gF6D6ug7k91v/NMwNFLfnt1wAVZXe1FNRNjpb0fE4eISqzzQzLL:QuuDdamuH1DLLfTwsXwNR9pb8J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a77b485f926b6ac9ac69201deebfdd02_JaffaCakes118

Files

a77b485f926b6ac9ac69201deebfdd02_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0aeab4185e2768f0c3b9bc32cf8ea2f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Information\Desktop\Windows\OS_Starter.exe

Imports

msvcrt

_cexit
_exit
__p__fmode
__setusermatherr
_XcptFilter
fseek
__p__commode
fread
__set_app_type
_controlfp
wcstombs
strspn
_initterm
_ismbblead
exit
wcspbrk
_amsg_exit
ungetc
__getmainargs

kernel32

FindResourceW
SetCommBreak
GetDateFormatW
CreateFileW
GlobalFlags
DeleteFileA
SearchPathW
FileTimeToDosDateTime
CreateThread
WaitForMultipleObjectsEx
GetShortPathNameA
MoveFileA

Exports

Exports

_ReplyMessageReplyMessageReplyMessage@0

Sections

.text
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ