d99f6af5b3c1b0e77c3a92e61ad99569_JaffaCakes118 | Triage

Sharing

General

Target

d99f6af5b3c1b0e77c3a92e61ad99569_JaffaCakes118
Size

11.9MB
MD5

d99f6af5b3c1b0e77c3a92e61ad99569
SHA1

e79db24426dd7cc2ce8abb077b955bcdb2ac2a50
SHA256

3cefc8264904b825e213bee5c67418cea3cb409fd6e76eb012c8dc016c4cabb8
SHA512

3bdf02e3a149747615a440513163990a90af6206af9994d8282a8f79a5f0bc96853f2e171993a925b8af0e72378d5dd5f71952958db30ebc0d39763a38ae4795
SSDEEP

196608:yg0o8PyfXttygWyaVqeIWGXf7Wr2vUanuIBKyJzBIwGtuqXd5QWFA:8yfX+yJWsTWr2vwzAznXqNXA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d99f6af5b3c1b0e77c3a92e61ad99569_JaffaCakes118

Files

d99f6af5b3c1b0e77c3a92e61ad99569_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2bb1e6ae08c31bb390074f70068196c2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__fmode
__set_app_type
_adjust_fdiv
__setusermatherr
_controlfp
strcpy
__p__commode
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strncmp
_strlwr
strcmp
memcpy
strlen
_except_handler3
_stricmp

kernel32

GetStartupInfoA
VirtualQuery
VirtualProtect
SetFilePointer
CreateFileA
ReadFile
GetModuleHandleA
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA

user32

MessageBoxA
wsprintfA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tData
Size: 11.9MB - Virtual size: 40.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE