fa987b5afa7144a14282f823c81231c6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa987b5afa7144a14282f823c81231c6_JaffaCakes118
Size

157KB
MD5

fa987b5afa7144a14282f823c81231c6
SHA1

24ce850f14dcb1aaa354960d12aada0cd6584361
SHA256

0746b6e3107eaedcd6cdee20e52f8b5078a1425b1f871c86b4faa511769ba1ed
SHA512

c455a1c6643093537e62f958a7f353d8c0178edd74a736ad7d60c240d54aa700357bd7d7a344bf7c39d531bee4bf835818dfbc28f544d0bf1408ad7d21b88001
SSDEEP

3072:uWx4L6T4jrndLKc9HJGap7r5icT0RSi4eRsHz/g5tYREb5FM:fx4L6UFvQC8chT4QKb5FM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa987b5afa7144a14282f823c81231c6_JaffaCakes118

Files

fa987b5afa7144a14282f823c81231c6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ