fafb75c21e2144b859a4f41eac40ef0e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fafb75c21e2144b859a4f41eac40ef0e_JaffaCakes118
Size

9KB
MD5

fafb75c21e2144b859a4f41eac40ef0e
SHA1

94bc234c251f4f8853d851833295f531585ce48b
SHA256

eb088590a60b07b65f01eafbbe48ae67ee53d1883c322757b5c2b753521a7a9d
SHA512

43ae16d682ece116e0b0932cf004a5b36132f73cabee195e8e4df283f0e62a7435badf9be14ae1e26b6a1ae56cbd77f5d3c74b3c737c4d63b75032d01f5b0f0f
SSDEEP

192:3R5Fhp8cdwpHR3AkPLiM79mLU2PcPl8ul5m:B5FZdgAkTiM79mgLZbm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fafb75c21e2144b859a4f41eac40ef0e_JaffaCakes118

Files

fafb75c21e2144b859a4f41eac40ef0e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9892338e2daa9eda983ff8396c009e4e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crtdll

memset
memcpy
remove
_mkdir
free
_chdir
_rmdir
malloc
_ltoa
strncpy
strlen

kernel32

GetModuleHandleA
HeapCreate
lstrlenA
GetModuleFileNameA
GetTempPathA
GetTempFileNameA
CreateFileA
GetFileSize
ReadFile
CloseHandle
WriteFile
HeapDestroy
ExitProcess
Sleep
GetExitCodeProcess
InitializeCriticalSection
GetCommandLineA
HeapAlloc
HeapFree
HeapReAlloc

shell32

ShellExecuteExA
ShellExecuteA

shlwapi

PathQuoteSpacesA
PathAddBackslashA
PathRemoveBlanksA
PathFileExistsA
PathRemoveFileSpecA

Sections

.code
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.flat
Size: 1024B - Virtual size: 621B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE