fb6bfdd4193977493b727a1c8d4d4360_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb6bfdd4193977493b727a1c8d4d4360_JaffaCakes118
Size

17KB
MD5

fb6bfdd4193977493b727a1c8d4d4360
SHA1

8a685b7226ce24589c681bd39eb5411881ecd279
SHA256

f35eeb803834836459741eba7e4c71e38107f0aa844c9a97bed1e19557607a46
SHA512

31221b6272e60e426c1c489df3ab9b89ed25dc4caa7b263a85171209e9cda1f9e39fc2658c1dddaa6948001c5c5369118e471d98c39ae3eafccb3bf5829bd051
SSDEEP

384:bw919oC/thR8AufPqBxjOJMGc8bO0ocwXwO79Qju:MDdP8gBj0g779Qj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb6bfdd4193977493b727a1c8d4d4360_JaffaCakes118

Files

fb6bfdd4193977493b727a1c8d4d4360_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c48c16d42d38157bd57f5f75e0d75f4a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetExitCodeThread
WaitForSingleObject
GetModuleFileNameA
GetProcAddress
LoadLibraryA
TerminateProcess
GetCurrentProcessId
Sleep
SleepEx
GetModuleHandleA
GetStartupInfoA

msvcrt

memcpy
strncpy
memset
strcmp
strcpy
calloc
malloc
_snprintf
strtok
strstr
_pctype
_isctype
__mb_cur_max
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strlen
free
_stricmp

Sections

.rdata
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE