fed392443c0f29bde9a763823e73ce0d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fed392443c0f29bde9a763823e73ce0d_JaffaCakes118
Size

127KB
MD5

fed392443c0f29bde9a763823e73ce0d
SHA1

ef12847501eb96e7b0ac42501ae6c60c7ab75f30
SHA256

7c4ed9431f087502b4d95babbe9820894a93b4d1b2a2450bcee8614dd09d19cd
SHA512

e808faeb0e2e52f3edc5ca3e3e3b128c541d3802420e279eda2edc7b32a8ad6f0d9293e2c678d11753806e8d17c700b8848b2ce2c03222af663c754b4d79f4cd
SSDEEP

1536:IvN3Xpcl1gmsjngN1gZ7OMMYh8vqLj3P2znBwP2GhcSkej+pS/vz8Z+Xsxat5:IN6lmgN1W7ODYJ2qVkJSXYZYsIt5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fed392443c0f29bde9a763823e73ce0d_JaffaCakes118

Files

fed392443c0f29bde9a763823e73ce0d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0058ba95a9d56dcd78433732fd228b3f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
EnumResourceNamesA
GetProcAddress
LoadLibraryA
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapAlloc
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ