bed5583414d208baa0f639f5fe45575d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bed5583414d208baa0f639f5fe45575d_JaffaCakes118
Size

66KB
MD5

bed5583414d208baa0f639f5fe45575d
SHA1

fded37c3545037ab782cd99d30525b78bf6339fd
SHA256

9a637a085fc3638cb588e37e8de898a730d296df7532abf49630db96edcbf1d5
SHA512

a248d8ca049443be3f5c221441f23726224692556d654dd3c1081ce5163138c7e3da3c722f0d14d061d32f64c9aadd4b8017e2ac69ba29d52341cad246b17975
SSDEEP

768:CCCy4Hv66Xl5KnLpjNxbghyjeiSl7wAEU+13PK7x/j4u7SXj513nVfOC:8Pl5KnLpvpjefkAEUs3C7x/3s5xnVfO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bed5583414d208baa0f639f5fe45575d_JaffaCakes118

Files

bed5583414d208baa0f639f5fe45575d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f9a832c95b599480e17d7b38c47012b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetModuleHandleA
LockResource
LoadResource
SizeofResource
GetProcAddress
GetModuleFileNameA
CreateMutexA
OpenMutexA
GetStartupInfoA
GetCurrentProcess
CloseHandle
FindResourceA
CreateFileA

user32

MessageBoxA

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

msvcrt

__getmainargs
strcat
memset
malloc
strlen
_except_handler3
_exit
_XcptFilter
exit
_acmdln
printf
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE