adb59390a46077ccd90a6b3460153001_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

adb59390a46077ccd90a6b3460153001_JaffaCakes118
Size

33KB
MD5

adb59390a46077ccd90a6b3460153001
SHA1

0dcb07a0987ee93a70726570c5d094d8f8139ff1
SHA256

088348217663f252d7ca28721ec575b4aef787b9ef0a3611be2aa56edd388395
SHA512

d982145e96ec36b6b12ccac95b978e749dc9bc952d9d56a9b4e871d3cb1db3402e5d788761808f7695b09e7e8854f9e8e4d463bcf479d29fddc0761ea584b907
SSDEEP

384:G4XTTeYkseGf9T44dAkMQfQHbrgG/cQ6i+B8D7rFgE7KF:9X9kz2t7kf/fHrFgcG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adb59390a46077ccd90a6b3460153001_JaffaCakes118

Files

adb59390a46077ccd90a6b3460153001_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fe5db82acba4930d8b7ddc4dcab540b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

pbvm80

ord137

kernel32

FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetCPInfo
IsDBCSLeadByte
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
GetACP
GetOEMCP
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
RtlUnwind
VirtualFree
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
LoadLibraryA
WriteFile
GetStringTypeA
GetStringTypeW
HeapFree
HeapAlloc
VirtualAlloc
GetProcAddress

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ