fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118 | Triage

Sharing

General

Target

fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118
Size

110KB
MD5

fb46fba7ac18e7ce99020b71f4c9ec84
SHA1

0d3c37bc1c886961652e3f732eaa9a6e07463114
SHA256

205d204777afb49d6639e90caded6358619a1cc6b4fd893c61b83652ea33a8e2
SHA512

a728545985246be96babdb370c7d43c94ede1112da9328d8916765cade10fdc3985a1c0aa99c44ee5962b4999499bb8de86a34bbf37ef139b344a55934abd1c8
SSDEEP

1536:xV1XF99fQgtVXMWnT8YtFzii7lF/BSNL9l2xisFtVlzkAyHCVDmi:dp/LnT8YtF+ihxBSNhsisFtDyi1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118

Files

fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8f472ca610143ee55dc5a0e242587571

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetTempPathA
lstrcatA
GetStartupInfoA
CloseHandle
WriteFile
CreateFileA
lstrlenA
GetSystemDirectoryA
lstrcpyA
GetVersionExA
CreateRemoteThread
GetModuleHandleA
GetProcAddress
GetModuleFileNameA
LoadLibraryA
ExitProcess
WinExec
GetCommandLineA
GetCurrentThread

user32

CharUpperA
wsprintfA

shell32

ShellExecuteExA

ole32

CoInitialize

msvcrt

strrchr
memcpy
strcpy
__CxxFrameHandler
??2@YAPAXI@Z
strncat
strstr
free
_except_handler3
_exit
_XcptFilter
exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
strlen
__getmainargs
_acmdln
memset

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE