b2d21a0f7643dda7e307f5e56dbcc90b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b2d21a0f7643dda7e307f5e56dbcc90b_JaffaCakes118
Size

37KB
MD5

b2d21a0f7643dda7e307f5e56dbcc90b
SHA1

a9962d3d9a36b2b1a983f3bd0e94ee8b86e79e02
SHA256

1c0950cef07e43d5842e9391b861f54f66eb1ad6f70a2e1a0574e5ad144ceb40
SHA512

b20791f9fa2f3bf6a1cac9d58202456791b468f3f5d3ac26ad0256fcc449de312e86788dba6470221624e9e58ee3a0ff72f94a7c09200088e6d29c61616310e1
SSDEEP

768:GxN1fx+KFyLoIBO33tSHSRvms5g8c95NLsJkBSSmlVmrcClj:GHZObo6SRvms5g8c902YSyjCV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2d21a0f7643dda7e307f5e56dbcc90b_JaffaCakes118

Files

b2d21a0f7643dda7e307f5e56dbcc90b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cc405bf3f9e096e34e0af9509fff57c8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleFileNameA
Module32Next
GetWindowsDirectoryA
Module32First
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetStartupInfoA

user32

CharUpperBuffA

msvcrt

_adjust_fdiv
strncmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
strrchr
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 958B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ