afdcd49cc135d16f4380b3a2f1821d63_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

afdcd49cc135d16f4380b3a2f1821d63_JaffaCakes118
Size

568KB
MD5

afdcd49cc135d16f4380b3a2f1821d63
SHA1

4bb9a06544265ef0dd9b37c8cbe52167b97541ce
SHA256

5b99212510554f8e94a0bfc58de088db06ea8e72e5b03714f803501187d76791
SHA512

b8dadb302745c5eed317c7e1c974f744e01b7ada1d53fca6ef517fd462120f80c458fe681397c29c9a3f6cfc19140cba69459511f34c21c87c71495e855eea95
SSDEEP

12288:/gE3OwritXFbmlvjxrpF4WPORfcqKQsprjJKEp9qj7JUQI5:/gErutJav9pvOZcqKJpPkg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afdcd49cc135d16f4380b3a2f1821d63_JaffaCakes118

Files

afdcd49cc135d16f4380b3a2f1821d63_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a6e9e233feacf2c7d9466d9daad5b009

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
GetCurrentThreadId
GetSystemTimeAsFileTime
ExitProcess
LoadLibraryA
GetLastError
GetCommandLineA
GetModuleFileNameA
GetTickCount
GetModuleHandleA
PostQueuedCompletionStatus
CallNamedPipeA

msvcrt

wcsncat
bsearch
_isctype
wcscmp
wcsncmp
_beginthread
_ltoa
tolower
_wtoi
sprintf
fopen
_pctype
_wfullpath
_getcwd
_wcslwr
_snprintf
_acmdln
_ltow
strcmp
wcscat
_access
qsort
strspn
_vsnwprintf
strlen
strcpy
wcsncpy
_wcsicmp
malloc
__set_app_type
fprintf
__p__commode
_wfopen
_beginthreadex
_stat
_wsplitpath
_onexit
_chdir

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ