bd1a2ba2146a6b0003d3254bdcdb2271_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bd1a2ba2146a6b0003d3254bdcdb2271_JaffaCakes118
Size

225KB
MD5

bd1a2ba2146a6b0003d3254bdcdb2271
SHA1

ee299a1beeb463c00bbcbbbd328e0a47746e21e1
SHA256

26920b8b0bd53d19bb277f6eda8fa77e9d84767f4fea020dcdbfd615aee17827
SHA512

da1a0c393ddc244ede6136479bd698032f06b5851ef6f2a2705284a5c1a1f45d942a72d7d2aeb1c23afa274d15eb5416b9533329810fee7d7ab641876400eae1
SSDEEP

6144:qmTR+T/zJ3GNeJkYrJytx5ASWd3BnmXe7T:V+7zFGjMJytDI3Vss

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd1a2ba2146a6b0003d3254bdcdb2271_JaffaCakes118

Files

bd1a2ba2146a6b0003d3254bdcdb2271_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.crdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE