db651dfda7f7dda980f9d53664993147_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

db651dfda7f7dda980f9d53664993147_JaffaCakes118
Size

229KB
MD5

db651dfda7f7dda980f9d53664993147
SHA1

f4980d0fcc69b88880ad77db70079377e84d3c1c
SHA256

8b2011846854dd4b4fbf0eeacf82830e26d3b95d4bb9a180dd4ba715c4f44650
SHA512

ed90335c11ad1bc5db309b27ff24a3148de4e956357c1a6030d7ff84722ac3ad186c1f9d2c4c2067a94ea00ca3d994067edad15f8d4291e501e10c724bc37b68
SSDEEP

6144:sSbscTdJUTXTvTnTmTMTdTJzmFYvWwnNh:nsWdJujbTAmpJzmFYO4h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db651dfda7f7dda980f9d53664993147_JaffaCakes118

Files

db651dfda7f7dda980f9d53664993147_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

. rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE