e178510cc1e835bbdb7605a1ad20e7fb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e178510cc1e835bbdb7605a1ad20e7fb_JaffaCakes118
Size

60KB
MD5

e178510cc1e835bbdb7605a1ad20e7fb
SHA1

bc3b4f59fc537cb63c319a8c4705f89f2148dd7e
SHA256

d1a521ba41f0ef6b730682fe2c4059d3f2a6b3964185b84c4c5c190cf3b929c0
SHA512

000d4a963f18828b934281b1d459ddd7a9821a4f3726c69fdd0146d1d0944dd1bfd15f78603de30fa830b1857e00bef3200f346c688f1da01dee468840fba199
SSDEEP

384:Cco4+epQ/D1i+8bfvgm/1lHmzTGf8CS2kj/LgynLMDlDQ9UfWqjC60:Fo4+e0pi+qgy1QzTGf6zfeDuYWqjC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e178510cc1e835bbdb7605a1ad20e7fb_JaffaCakes118

Files

e178510cc1e835bbdb7605a1ad20e7fb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2de711cc410e1c08a8508e229c0d8f60

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetSpecialFolderPathA
ShellExecuteA

msvcrt

__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_acmdln
__p__fmode
_access
_except_handler3
_controlfp
exit
_XcptFilter
_exit
strchr
strlen
strcpy
strcat
fopen
fprintf
fclose
strrchr
memset
sprintf
__p__commode
__set_app_type

kernel32

GetModuleHandleA
GetStartupInfoA
CreateFileA
CloseHandle
GetFileTime
SetFileTime
GetWindowsDirectoryA
DeleteFileA
FindFirstFileA
CopyFileA
FindNextFileA
FindClose
GetModuleFileNameA
GetVersionExA
WinExec
Sleep

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE