b6e4da0b84686d41e3c68dc3c6710368_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b6e4da0b84686d41e3c68dc3c6710368_JaffaCakes118
Size

32KB
MD5

b6e4da0b84686d41e3c68dc3c6710368
SHA1

3ce791ae0bd61cdd862d21b983cc23c4b0d3309b
SHA256

610769d36671fbe3dd9be64371cc1e2ed9a8b088c4f63d93b4665cc6b5357cfc
SHA512

19c8057282b7c5f6d47707ee44b2142a70bd8bb7280eadeef669f7906d2100b4fd7a76e059c2d984990ff72b750d99d4e2edb0800a49d2289c0e2aa573981d8d
SSDEEP

384:0RvBHU3iafoXGBW/KjpLDGoVSbGAgPM2a9f4O1opewaUU3rt5:Q5Oiaf1WWHkbGAgs4x8U8J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6e4da0b84686d41e3c68dc3c6710368_JaffaCakes118

Files

b6e4da0b84686d41e3c68dc3c6710368_JaffaCakes118
.exe windows:1 windows x86 arch:x86

e659532a1719644d70ede4885cb4b958

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

vfwprintf
__p__fmode
fwprintf
_winver
__set_app_type
_wcsdup
__p__commode
tmpnam
_filbuf
_wspawnl
_controlfp
_initterm
exit
_except_handler3
_acmdln
strcmp
_adjust_fdiv
_XcptFilter
_popen
_mbsupr
__setusermatherr
__getmainargs
memcpy
mbtowc
_exit

kernel32

TerminateProcess
LocalFree
OpenEventW
SetFilePointer
GetStartupInfoA
HeapReAlloc
SetEnvironmentVariableA
WriteConsoleA
OpenProcess
GetModuleHandleA
ReadFile
GetCPInfo
GetThreadContext

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 157B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ