b373a3a9d38429f1a5f34d59c58319e2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b373a3a9d38429f1a5f34d59c58319e2_JaffaCakes118
Size

20KB
MD5

b373a3a9d38429f1a5f34d59c58319e2
SHA1

6f38af4785574067b7376110f59da5103e4b43a5
SHA256

24e9a8d44bd2169dcf7d553d541bbee30d8f0788448d12132c2d9fba048d9147
SHA512

923b89166a63d9e984045db21f14f413f59028a684f034d768985c883f393b504f4e2ed2ac369c2dd1652222f0c13079d009cbaeddfb3f130e3a500f664ffd26
SSDEEP

192:qENdNDxSZlKNx+Ymcv7kIz4xIAKBxfP1oynMdn:qobnmUn1Kd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b373a3a9d38429f1a5f34d59c58319e2_JaffaCakes118

Files

b373a3a9d38429f1a5f34d59c58319e2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d6b970eaafedd093e793b8138376d108

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord541
ord940
ord540
ord2818
ord4202
ord6283
ord6282
ord6143
ord3790
ord354
ord860
ord536
ord6883
ord939
ord801
ord4129
ord535
ord5683
ord858
ord800
ord537
ord6930
ord665

msvcrt

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
__p___argc
__p___argv
_mbslwr
srand
time
rand
__CxxFrameHandler
atol
_stricmp

kernel32

GetModuleFileNameA
Sleep
GetTickCount
WinExec
MoveFileExA
GetLastError
WritePrivateProfileStringA
GetPrivateProfileStringA
GetModuleHandleA
GetStartupInfoA
GetSystemDirectoryA

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE