ad476b40046aaa137624063542e4ceca_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad476b40046aaa137624063542e4ceca_JaffaCakes118
Size

156KB
MD5

ad476b40046aaa137624063542e4ceca
SHA1

da03072c00fb97e986bb90169635b1e854c0e01f
SHA256

80c4a141c26e348a862a92e85cc13ba2a2cd1d0f2de5ec0f77225453e2718c21
SHA512

3ff0918c5175274f970e6858259727e921bdd1d76fc70d0ff8f1741a290b75e76a6b8de85675d9ec99a44139a7313256f4fc61d4ae3721a7036df38eb70f5f2a
SSDEEP

3072:dw8jFPvGKUivAIag4DJhRP+Pa313NGzpn6N2orih:yQgKVvja9nRP+ElAp6i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad476b40046aaa137624063542e4ceca_JaffaCakes118

Files

ad476b40046aaa137624063542e4ceca_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1d4841e40c5f92d1917d6ec9b95c66ea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
calloc

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
OpenProcess
GetProcAddress
lstrcpyA
GetModuleHandleA
IsDebuggerPresent

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.LnHGv
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ