fbb0db98d52480168df040ec34b0ac49_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fbb0db98d52480168df040ec34b0ac49_JaffaCakes118
Size

85KB
MD5

fbb0db98d52480168df040ec34b0ac49
SHA1

12827ac79f45635a89b8c05b6d06faf81eba46dc
SHA256

4b46fb83b61db252f5e6f58d6e8dc106ec6fd4db314d7e1e129b52b6669448c9
SHA512

741ddc5880d38b4e8e026fb00b43fd2399fd28a7ed353b871906ac277bccfd39d5392fce8b7c75560172bcfd1172fa5526443b8dda69dc83a05308581b5eacbc
SSDEEP

1536:y3cThMP1iIOycbxh94xHTtkhMfwDxIX52F2qpyfVMtOPRs:ysThNrbxgHTUGa620MtOPRs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbb0db98d52480168df040ec34b0ac49_JaffaCakes118

Files

fbb0db98d52480168df040ec34b0ac49_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bfb79b0c97dd88464f805d81c35afc7f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

fclose
_exit
__getmainargs
malloc
cos
wcslen
__p__fmode
__setusermatherr
strcmp
_initterm
free
exit
fwrite
fopen
fputc
_XcptFilter
__dllonexit
_acmdln
strchr
__p__commode
_adjust_fdiv
_except_handler3

kernel32

GetStartupInfoA
VirtualProtect
GetModuleHandleW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE