fc14ba664287893874e9425c7ee66977_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc14ba664287893874e9425c7ee66977_JaffaCakes118
Size

41KB
MD5

fc14ba664287893874e9425c7ee66977
SHA1

49670e791c637d89f0faf35190d0caa781945598
SHA256

4e5dae28ca8bcc6a68f2f61493f80128b692b0baa819652b6841af6d747f2a48
SHA512

04b6ae24d20f80ffbe559e82d71835bf555ed42ad69db029d285280c846afd5901cc1046e23d643f73659bb4136a7f834fdc7bb6571d6f8d14e35127ab2a3caa
SSDEEP

768:pFU2yzzPvAp4+mdVP+2+oweRhQe8N64Ne4FeBGZMnL0TSJHiQ37:zUf/Ap4lVP+LRevWFFe4ZNTSJP37

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc14ba664287893874e9425c7ee66977_JaffaCakes118

Files

fc14ba664287893874e9425c7ee66977_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7a315aa9c507a0b36de0d96e822d87f3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3

kernel32

lstrlenA
ExitProcess
WaitForSingleObject
CreateThread
lstrcatA
lstrcmpA
GetLastError
CreateMutexA
lstrcpyA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetCommandLineA
WriteProcessMemory
lstrlenW
GetModuleFileNameW
Sleep
ReadProcessMemory
GetModuleHandleA
IsDebuggerPresent
lstrcmpiA
AllocConsole
HeapFree
GetEnvironmentVariableA
HeapAlloc
GetStartupInfoA
GetProcessHeap
GetCurrentProcess

user32

LoadMenuA
TrackPopupMenu
DestroyIcon
MessageBoxA
MessageBoxW
GetWindowRect

gdi32

SelectPalette

ole32

CoInitialize
CoCreateInstance

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ