f99f6cc3b9183ac1c601f2a0337eb0bd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f99f6cc3b9183ac1c601f2a0337eb0bd_JaffaCakes118
Size

1.5MB
MD5

f99f6cc3b9183ac1c601f2a0337eb0bd
SHA1

503ff6635e0855181c9fc35a87cbf66d245e9879
SHA256

48df5bce5abefb4479083d2994ddc2c973a23723635a9a606e002a13e680d0b2
SHA512

b3180459b043bf25ecf7d5dfb0fc0b8fb1658fa1b0a8caafdf6a33437e438debd93be41f66b913b2b2bebd37170ddce26e174235499c6959eccc8b9210573a00
SSDEEP

24576:HiybUhRrN+L9DTONGZJ1LdbOqXjicS8mdyP8QyZoHHfn2w4mBYVzjowvjSgZ7yh/:H6qhpv1LdbOqTicS3I/n4mBN5b9J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f99f6cc3b9183ac1c601f2a0337eb0bd_JaffaCakes118

Files

f99f6cc3b9183ac1c601f2a0337eb0bd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b15de66230ef79b9b3facda6874287a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
CreateFileA
LockResource
WriteFile
CloseHandle
GetProcessHeap
ExitProcess
HeapAlloc
HeapFree
IsBadReadPtr
GetEnvironmentVariableA
GetModuleFileNameA
WaitForSingleObject
CreateProcessA
GetStartupInfoA

user32

wsprintfA
MessageBoxA

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE