da605f9078dd3a4742f1610d7ab0ac42_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

da605f9078dd3a4742f1610d7ab0ac42_JaffaCakes118
Size

128KB
MD5

da605f9078dd3a4742f1610d7ab0ac42
SHA1

e3d919db3c511feeaa627b266d2cb5b53e2217a9
SHA256

2644e0b801c7f32d78edeeec7d31cd69bb855a70ad5ed02de963f96997e7c09b
SHA512

40a7a8bdc518ebd960ec22598d34b62b03197ca447e37a45b17c5196f08fbedb87b5e0d01a0a4852eb8c0787902e9d21580fda13cc6bb64648383b66b2262b1c
SSDEEP

768:3E30e/7tEaWcArSwaydTb0EroSd3QXGsBS4sZFFSUv6GfEK+RsWW2qTN4lvCy2Zv:A+PeXonnUStQXDI4spvVp+N8NECtH3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da605f9078dd3a4742f1610d7ab0ac42_JaffaCakes118

Files

da605f9078dd3a4742f1610d7ab0ac42_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2297193c56939c117ff494073c528fab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

send

msvcrt

exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
_exit
rand
sprintf
malloc
strtok
atoi
free
fopen
fclose
_adjust_fdiv
_controlfp

kernel32

GetModuleFileNameA
GetCommandLineA
CreateFileA
WriteFile
CloseHandle
GetModuleHandleA
GetProcAddress
Sleep
OutputDebugStringA
GetStartupInfoA
DeleteFileA

user32

MessageBoxA

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA

ole32

CoInitialize
CoCreateInstance

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE