d637b9a5250b93cf924340991f29bea8_JaffaCakes118 | Triage

Sharing

General

Target

d637b9a5250b93cf924340991f29bea8_JaffaCakes118
Size

36KB
MD5

d637b9a5250b93cf924340991f29bea8
SHA1

21946b9b53193f928a4b584e6b91b74c125f6d4a
SHA256

a4d395d07ce4edf7c97364c4e2d2f84ba1d02c5024fa40703689b399c4787885
SHA512

89c903dff6a3556fc63e656f484d33bd189e5d349793df5d9ef0278cfaf5ad540ff1847ba1286b56eacd05847e8286ccf4ec0d0285cd91c569579f931cafb2c3
SSDEEP

384:4fSR5jIoU1ymlzyraLyxprhkoX9MmIO5HjSshs8sqZoE0iYA7gSNyH:445a3kBhkoX9MmIO5Hjh2zqZoE0ijnE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d637b9a5250b93cf924340991f29bea8_JaffaCakes118

Files

d637b9a5250b93cf924340991f29bea8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e99291db6f249e76f63dc233a4585eb4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
GetWindowsDirectoryA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE