f621be555dc94a8a370940c92317d575_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f621be555dc94a8a370940c92317d575_JaffaCakes118
Size

149KB
MD5

f621be555dc94a8a370940c92317d575
SHA1

c1cb49224a98097a39be30e063a9d81f2bdc04cf
SHA256

eee04e6f165b8cd2fa455403a93f24acda2ff10c18df8e22850b881996338137
SHA512

8be9ce9f6998ef97648ab22a54d826940e338b5d1c02c126e8f557d0ca56eec07f59d31697f246f0be51576a05b2ec151a283ec557bb31205307929152ca99b0
SSDEEP

3072:FORtIRHi+qZGsVFbcAmWxFHY94cG80PQfPuCPHv1s5:gR+RCusVZbmWxFHYjGQPPP+5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f621be555dc94a8a370940c92317d575_JaffaCakes118

Files

f621be555dc94a8a370940c92317d575_JaffaCakes118
.exe windows:4 windows x86 arch:x86

562654997349ff5a84997b1d4889e304

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memcpy
longjmp
fopen
_setjmp3
fclose
malloc
free
strlen
exit
__p__iob
fprintf
sprintf
fwrite
fflush
ferror
getenv
sscanf
memmove

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
DeleteFileA
HeapFree
TlsGetValue
HeapAlloc
TlsSetValue
TlsAlloc
HeapReAlloc
WaitForMultipleObjects
EnterCriticalSection
CloseHandle
LeaveCriticalSection
GetCurrentThreadId
InitializeCriticalSection
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
CreateThread
ReleaseSemaphore

user32

CallWindowProcA

Sections

.code
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_WRITE

..
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

..aer
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ