005874b0043f1c8fd6b2a8987113dc78_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

005874b0043f1c8fd6b2a8987113dc78_JaffaCakes118
Size

19KB
MD5

005874b0043f1c8fd6b2a8987113dc78
SHA1

3f2ef240b820a9ef98b23d767df3e443e516e4b2
SHA256

654544cfde6419267c873bffde2ca4f761cf25188897cb70bd4fb6e551572b3d
SHA512

dbdf4e6c1b7573255d8c4d270c0ef275569c02724239a0d8b21a72b2e29e81fb43a562c2c7d79d08a2e02bfa6033b8e899eaeb3e3ef3df2ca6dc1dfbbe4cdcce
SSDEEP

384:cY+nIbxs8x1Y/oz5n6s2j4IXPjPS5bsnKoxcCMCjKJQea1:cYc4CgObbPXCCMEKJ8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
005874b0043f1c8fd6b2a8987113dc78_JaffaCakes118

Files

005874b0043f1c8fd6b2a8987113dc78_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4b574c7ec06e4434d852d382f0d7dcc0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
WriteFile
CreateFileA
GetTickCount
LockResource
LoadResource
SizeofResource
FindResourceA
WinExec
Sleep
ExpandEnvironmentStringsA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
CloseHandle
GetModuleHandleA
GetStartupInfoA

msvcrt

sprintf
strcpy
strcmp
_iob
memcpy
??2@YAPAXI@Z
printf
??3@YAXPAX@Z
rand
srand
malloc
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strlen
strcat

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ