ea59fc75406edc43744f0be52bb0d5f3_JaffaCakes118 | Triage

Sharing

General

Target

ea59fc75406edc43744f0be52bb0d5f3_JaffaCakes118
Size

192KB
MD5

ea59fc75406edc43744f0be52bb0d5f3
SHA1

fb662c501b1606e083b955980481c96447db0008
SHA256

3581a006abb1e42d2c9073897960d2c3de5ee1780ca3f621437639039bf1dee0
SHA512

c1302b22ec98aa19709c04b9235a69b91c0779333545db82d1feec5e8389d84e5df13c703a32546b1873c89f0928b643d9d6e966af76ec835934caa36180d327
SSDEEP

3072:oY8Ji/oo0CPabt2S2RTw2HDqzmVasFp6bRU0srp:oTWKvt2S2ZqzmQl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea59fc75406edc43744f0be52bb0d5f3_JaffaCakes118

Files

ea59fc75406edc43744f0be52bb0d5f3_JaffaCakes118
.exe windows:1 windows x86 arch:x86

bcd3c2ae7e6b896b2db74c26fa80a9b8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__fmode
_wfindnext64
__setusermatherr
_controlfp
_acmdln
_commode
_initterm
_cputws
_mbsncoll
__set_app_type
_mbsnextc
_wtmpnam
_fpieee_flt
__getmainargs
exit
_wsystem
_exit
qsort
_safe_fprem
_except_handler3
__p__commode
_adjust_fdiv
_XcptFilter
memcpy

kernel32

lstrcpynA
DeviceIoControl
LocalFree
GlobalUnlock
HeapAlloc
GetModuleHandleA
SetEvent
RaiseException
GetProcessHeap
GetVersion
GetStartupInfoA
TerminateThread
GetConsoleCP
HeapCreate
WideCharToMultiByte

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ