e05948a22220fbb5326178a5f09c51e6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e05948a22220fbb5326178a5f09c51e6_JaffaCakes118
Size

152KB
MD5

e05948a22220fbb5326178a5f09c51e6
SHA1

d2bc60384cc87e89b03ef85ddc0f9868286d46de
SHA256

29c28090f26a42c6766ccb5ae0ca100f7938f45c80893211ffd11f46b0cded32
SHA512

89b02a49f13d7c36cbf5bd819700454598c22d0dc9575238ecc6ee3f0dbec42430304429c720c4f5238f4d9f7682b75b4647791e9012a695c4b44487debcb3de
SSDEEP

3072:vxv0qVC9+dqf/KDfCUymmuHTiCox3I9Qb:pv0qAqfCORaI6b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e05948a22220fbb5326178a5f09c51e6_JaffaCakes118

Files

e05948a22220fbb5326178a5f09c51e6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ