db252aa98882b0f082efb32144cdeacf_JaffaCakes118 | Triage

Sharing

General

Target

db252aa98882b0f082efb32144cdeacf_JaffaCakes118
Size

14KB
MD5

db252aa98882b0f082efb32144cdeacf
SHA1

2bc3bf35a3f333e0a6630ad1210868e40e64cee6
SHA256

1301f994e2e12da4fcc0b49de0710afecf40d8a9b74030bfa51b6781db4f0b90
SHA512

0b7631328c7b14df6647cee935cba6dd2434346304ca4f249312184017cb422b2effb0055789297709ee88a2c2c71d38b5f8c82885df8e10805579fe39966870
SSDEEP

384:h964bS7TweUpGNHMCUGkH3trZfYCWBU4YBLJ3tf0OKw0YgEza:hA4MKhlUYgEO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db252aa98882b0f082efb32144cdeacf_JaffaCakes118

Files

db252aa98882b0f082efb32144cdeacf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

12ae5f7e40332ef0e351e4f536f4911b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strlen
_getch
malloc
_strlwr
strcpy
strcat
strcmp

kernel32

FindResourceA
GetCommandLineA
GetModuleHandleA
GetStdHandle
CreatePipe
SetStdHandle
GetCurrentProcess
DuplicateHandle
DeleteFileA
WaitForSingleObject
CreateProcessA
CreateFileA
GetModuleFileNameA
GetTickCount
LockResource
LoadResource
CloseHandle
GetTempPathA
WriteFile

user32

LoadStringA
wsprintfA

shlwapi

StrToIntA

Sections

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ