dd004e659ac48345730721f8dd7f5eed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dd004e659ac48345730721f8dd7f5eed_JaffaCakes118
Size

405KB
MD5

dd004e659ac48345730721f8dd7f5eed
SHA1

0e5968e1717cc7a50d7930904b184963a2e5f5b7
SHA256

654ebce6d1b93abb1a1059b69b54a9ed874b64a502d268b5eaef4cc8e88cc2ca
SHA512

e9c06e84a71520d943dd332382702f6aa5b44a54c8bc201daf9a7f179013e88b3e3dad19faab36c263548117ad3e616089e995606e46defe6c850deef577d7f1
SSDEEP

12288:7T76853BUJcfp6rtf4b/WYlPBcuTogIA2KVPX366:b32WIQ/3xBcCJ966

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd004e659ac48345730721f8dd7f5eed_JaffaCakes118

Files

dd004e659ac48345730721f8dd7f5eed_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7ddd00370a67247bbb4b17d82a5439b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetLastError
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentDirectoryA
GetEnvironmentVariableA
GetShortPathNameA
GetTickCount
WideCharToMultiByte
GetStartupInfoA
GetModuleHandleA

user32

MessageBoxA

shell32

ShellExecuteA

msvcrt

??3@YAXPAX@Z
exit
atoi
strtok
??2@YAPAXI@Z
_except_handler3
strstr
free
malloc
wcslen
wcsrchr
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_stricmp

ws2_32

gethostbyname

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ