d27c94cd25fd00c301aeb0a17c6b4ac1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d27c94cd25fd00c301aeb0a17c6b4ac1_JaffaCakes118
Size

22KB
MD5

d27c94cd25fd00c301aeb0a17c6b4ac1
SHA1

5fefa64889946bcabf2aacfd2062047517127233
SHA256

d26b5689fdd278455e1184e1afb55d1c42a2866cd3e5a7026e4c1a688d96f378
SHA512

86d61d62acb304c17926aad877b5fcfa8658a70b4f4327200c24301691ca503003ed470d0230bb15e298e3148e477dfe6cba76b162c21fbf7688224304827147
SSDEEP

384:B81XzqDt14wI60Gd9NLPc0EBQ2btuXTMs/sTEs3EC:6kPt91EWCwXY0C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d27c94cd25fd00c301aeb0a17c6b4ac1_JaffaCakes118

Files

d27c94cd25fd00c301aeb0a17c6b4ac1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cdf47e23254e96111d51da1cc79edbf0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadProcessMemory
VirtualProtect
VirtualQuery
WriteProcessMemory
CloseHandle
ReadFile
GetFileSize
CreateFileA
Sleep
ResumeThread
CreateProcessA
FindClose
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
GetModuleHandleA
GetStartupInfoA

user32

MessageBoxA

comdlg32

GetOpenFileNameA

msvcrt

_adjust_fdiv
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
??3@YAXPAX@Z
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ