e085035b84f0a7cdddc2962b2fdf7620_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e085035b84f0a7cdddc2962b2fdf7620_JaffaCakes118
Size

151KB
MD5

e085035b84f0a7cdddc2962b2fdf7620
SHA1

515772d7916b2e9fba8f21e15095d35ae829ad61
SHA256

9014f150ba1b0b00a48957a8a472c384be14cf3e04de9012836da0c6b0d82f55
SHA512

4118ef9d96aeb4a6f662735c71380159e05f4bc9cc8dd89ae4adbdbec48847281d2abe1c8a4187e2ed0e11fb139eebd01dd97e14cc393ecdf1b1c91b960a54a2
SSDEEP

3072:1Us2G64k9OSCd6oz5zqjcLOnv6t6v7zHk:gC6oz5zqjSOv6tOE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e085035b84f0a7cdddc2962b2fdf7620_JaffaCakes118

Files

e085035b84f0a7cdddc2962b2fdf7620_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ