ad43b5f78d5a4828fa0bc8b80edc5a05_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad43b5f78d5a4828fa0bc8b80edc5a05_JaffaCakes118
Size

29KB
MD5

ad43b5f78d5a4828fa0bc8b80edc5a05
SHA1

4f35215f526f99d9db68fc97cb0f436f589760dd
SHA256

b3875e045ccadf962850a8bbf3c7aba6c760d12cf66327ff8910ec6a19e4207b
SHA512

805bae9d5a162b3704c4ffc75670257f596df744f14bfb4bca6caf8e8dcecebe92fd522b5263437ea7ec76c363831399cdfc315e64ba13a96b3a2437ac4a170e
SSDEEP

384:9LDu4fcXG0feC2hfuWjb8h6Jw/HOxALczZdzuKJq3rwnwtLf90W:9DG2Ee/UA8hFu2QzCKJqKwt+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad43b5f78d5a4828fa0bc8b80edc5a05_JaffaCakes118

Files

ad43b5f78d5a4828fa0bc8b80edc5a05_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ea6b024073c6dff1ac7c4399864b6707

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetModuleHandleA
lstrlenA
lstrcatA
GetEnvironmentVariableA
WinExec
Sleep
CloseHandle
WriteFile
CreateFileA
CopyFileA
GetSystemDirectoryA
GetVersion
SetFileTime
GetLastError
GetFileTime
GetWindowsDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot

msvcrt

malloc
memmove
_strrev
_strdup
??2@YAPAXI@Z
_strupr
free

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 645B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE