d2f72e2f2b4ff61a3eaa575ceaaa6b98_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2f72e2f2b4ff61a3eaa575ceaaa6b98_JaffaCakes118
Size

16KB
MD5

d2f72e2f2b4ff61a3eaa575ceaaa6b98
SHA1

fa309fb7cf695c527996926d26997e0bef501b0e
SHA256

db499c1a83d1bbefc6063c5bc6d6d7d424d14407577ba4656906c3696caf4d3c
SHA512

2a05af368aa04f37766c6d13c75c921ef43eaae960d79bfbb18ab58d4b29ef8d8fa2dc09d95beab87ccd52d1dd0de8cbf7445bdf8b8660676757146398b2c0d0
SSDEEP

384:kqrw1ju1NHzNonDL9pmFhDXnaLboFMKI4NR3N:Drw18NTyDppmLaUjI+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2f72e2f2b4ff61a3eaa575ceaaa6b98_JaffaCakes118

Files

d2f72e2f2b4ff61a3eaa575ceaaa6b98_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e4c09fe5863e1e88da11390ab3f9f00c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
LockResource
LoadResource
GetSystemDirectoryA
GetEnvironmentVariableA
lstrcatA
lstrcpyA
GetShortPathNameA
MoveFileExA
GetModuleFileNameA
GlobalAlloc
GlobalFree
GetModuleHandleA
GetStartupInfoA

shell32

ShellExecuteA

ws2_32

WSCWriteProviderOrder
WSCInstallProvider
WSCEnumProtocols

msvcrt

exit
_controlfp
free
fclose
fwrite
fopen
strcat
swprintf
memcmp
wcscpy
memcpy
_exit
_XcptFilter
malloc
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ