fe93b13b8fb8c65f02b0e97031ca3bf6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fe93b13b8fb8c65f02b0e97031ca3bf6_JaffaCakes118
Size

204KB
MD5

fe93b13b8fb8c65f02b0e97031ca3bf6
SHA1

63d41e7d9bfb4ceafc91f913c1972010161f6761
SHA256

23d8a73b4f1112d5b42406f4457f1ff4d5b548878ab2b635aed600a009f19620
SHA512

555d9f8799135c783455b755cb70c0cc460a87577b1f330878a3056ca28bcef49f41755b1b4aad1a626844678a6dbb817234d98301c69a2b0f0171280e410b6d
SSDEEP

3072:R41ztVXERG/jD4gn6jcqv94RlnQGSDTGXrrLRF:RTgAcqvTDTGXrrLRF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe93b13b8fb8c65f02b0e97031ca3bf6_JaffaCakes118

Files

fe93b13b8fb8c65f02b0e97031ca3bf6_JaffaCakes118
.exe .vbs windows:4 windows x86 arch:x86 polyglot

eb5ea5a73a9e73eb3bde0b0393e81c95

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
Sleep
lstrcpyA
GetStringTypeA
LCMapStringW
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
GetStringTypeW

user32

MessageBoxA

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE