fc9b295675a9599147913ef7ac3592e9_JaffaCakes118 | Triage

Sharing

General

Target

fc9b295675a9599147913ef7ac3592e9_JaffaCakes118
Size

1.4MB
MD5

fc9b295675a9599147913ef7ac3592e9
SHA1

13649e7225fa7f421aab96012be48bf90c1a3569
SHA256

5e13b33366f9f5fe99304ce1e366a5747db20ad5571da48884aed5d9f5f4d1f2
SHA512

fdc70608b6569b1461a9b89e7d5ed1dc0369a14d9c0238766cdeb7b08c96638eba9ee7b67824e519f668d6b1ea96e3c5127451270cfac24126bc70055a272d0f
SSDEEP

24576:2Fwbwel4JdSgL8FSOBjalcRFvGac/P86HxidJXP60:2FCrFSOBjaluv4lYjXf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc9b295675a9599147913ef7ac3592e9_JaffaCakes118

Files

fc9b295675a9599147913ef7ac3592e9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

697f75d8bbef79d0e90eb8e947c4c2bd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
MoveFileExA
HeapFree
WriteFile
Sleep
DeleteFileA
CloseHandle
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CreateFileA
lstrlenA
ExitProcess
lstrcatA
lstrcpyA
CopyFileA
GetTickCount
GetTempPathA
GetModuleFileNameA
GetCommandLineA

user32

wsprintfA

shlwapi

StrStrIA
StrRChrA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ