d3338e83f7054e7c3d879c3e46885063_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3338e83f7054e7c3d879c3e46885063_JaffaCakes118
Size

363KB
MD5

d3338e83f7054e7c3d879c3e46885063
SHA1

0e276e5627628bdda756329d2f677c1f93fad6b0
SHA256

215a448f6e5814e132790ec25eb1338a50f3c74381e7ff033decb6c8612d41c8
SHA512

1901351794bb24e83126df025b92d439da5930530af516d1a35285108c2a0d257ed08d5b44afaad029d48251324bd0d74b15d3d9c9c97a33d3b73df8eb4c3810
SSDEEP

6144:f3QEP4qA0okFl+LpUMcaAfq3+J2DSKOYQhz+OTPSjwQtiFORDLcvpwQ6H:f3QEbplS9dAfq3+J+SLp+BjltgyFP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3338e83f7054e7c3d879c3e46885063_JaffaCakes118

Files

d3338e83f7054e7c3d879c3e46885063_JaffaCakes118
.exe windows:4 windows x86 arch:x86

77ab2c0fc3bfd997edb868c3fc4a8aa4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCommandLineW
GetTempFileNameW
FindResourceW
FreeLibrary
LoadResource
HeapAlloc
HeapFree
GetModuleHandleW
GetProcessHeap
WriteFile
LoadLibraryW
SizeofResource
FormatMessageW
GetModuleFileNameW
CreateFileW
GetProcAddress
GlobalFree
LockResource
CloseHandle
DeleteFileW

shell32

CommandLineToArgvW
DoEnvironmentSubstW

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 782B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 345KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ