fb9bbb676645520c4334380bcbfa3eb3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb9bbb676645520c4334380bcbfa3eb3_JaffaCakes118
Size

114KB
MD5

fb9bbb676645520c4334380bcbfa3eb3
SHA1

ba7f8995ed427bfc99a25a3ff4e369aa76e738dc
SHA256

a7a15876ee819bab134f53f8cee6ab5c1b4e833afd7003bc394f4b092ed64d1e
SHA512

553a759dafffe71f8a65b0bebc627df982365b479e17913b57a375db25f0d7a5955f6c0253aab0bc20f227ff635221e3c0b2259bba3b6d5f2b030d226dff9cbb
SSDEEP

3072:C6OYNQKPWDyDRefVJltZrpRl1P3w9ZJGHAAkBjTEl:NXNSDyDRO1thpcZJANajs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb9bbb676645520c4334380bcbfa3eb3_JaffaCakes118

Files

fb9bbb676645520c4334380bcbfa3eb3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d1e7236347998e83248793d86f16ab75

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
CopyFileA
ExitProcess
FindAtomA
GetAtomNameA
SetUnhandledExceptionFilter

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fclose
fflush
fopen
fprintf
fputc
fread
free
fseek
ftell
fwrite
malloc
rewind
signal
strlen

shell32

ShellExecuteA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE