d9f636644bc0aa1ed621335931c0b946_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d9f636644bc0aa1ed621335931c0b946_JaffaCakes118
Size

77KB
MD5

d9f636644bc0aa1ed621335931c0b946
SHA1

a9d544f53eb82bdc0bd3fd4b749da775cb8c1a3f
SHA256

a2a28741c0a75527f760673196b89f776b2e4ee8858f081bb84d6fa64c84d8ff
SHA512

d6b50eba0bce40302c932a96eba384a5040114b2eacdacd6b8615fa1eb32b1aba0201d3653872f50163047281968d244cf4619ffb39d1d9333cb61d3d1885bc9
SSDEEP

1536:I7tIvPEn9GV20lxVEx0z9wjsNrt9ph4q0gWQT+iVoQ7T:IZIE9G40Kgwaz4q9swT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9f636644bc0aa1ed621335931c0b946_JaffaCakes118

Files

d9f636644bc0aa1ed621335931c0b946_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c380e5d13aac4051d3eea97d91175a12

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

printf
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
atoi
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strcpy
srand
rand
free
_snwprintf
wcscpy
memset
sprintf
malloc
_snprintf
memcpy
strlen
fopen
fclose
strcmp
_adjust_fdiv
strstr

kernel32

SetErrorMode
DeleteFileW
GetModuleFileNameW
GetCommandLineW
TerminateProcess
GetTickCount
MultiByteToWideChar
CreateFileW
WriteFile
CloseHandle
Sleep
SetLastError
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA

ws2_32

closesocket
socket

user32

MessageBoxA
GetClassNameA
IsZoomed
FindWindowA

shell32

SHGetSpecialFolderPathW

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ