c962045828149ab00b2957663b23da76_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c962045828149ab00b2957663b23da76_JaffaCakes118
Size

152KB
MD5

c962045828149ab00b2957663b23da76
SHA1

af4f44ffafae0fe49bf0807f18f634171b68e45c
SHA256

0ffcfafd9ebf1785d1ae52c3e93e92ca94d790da615fa633d1efd86790641495
SHA512

c1db32a7062feff9be5100e098ff3565caba8f6cf45c50d34a2e07ee4adc741f17c7a3a7281b0feb04c880a9fca3f176fe0168f2ed60a47df829a06d3d91a70b
SSDEEP

3072:hGTPCdQwjEtTAJg9LdRqpbwNsVFcgt9AS4IVp85R7sw:hGTwFg9pSast2xI785RX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c962045828149ab00b2957663b23da76_JaffaCakes118

Files

c962045828149ab00b2957663b23da76_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ