017cc51722ca3f980e427a199ebba272_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

017cc51722ca3f980e427a199ebba272_JaffaCakes118
Size

1.0MB
MD5

017cc51722ca3f980e427a199ebba272
SHA1

4208d21a90aeecefcebda05db94afcc31f972f6c
SHA256

f314f259ef8cdfa3e9b4cb4bc91c4c7274ad8cd444c7c26d26bd58fa7e8cc898
SHA512

f9f081e69c79973b5b8629053c14c362a3fabf33f6325566e7315803b6e45fc6e84f767ed53c8fe66854449561e86c02b534a87d139b630ba454f4797d9795d4
SSDEEP

24576:4edZPLbtqs5kFAfr6RZ/bnp6dHcP8p+Dia7ec:4eTPdqs50AD6RZ/bngB+bec

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
017cc51722ca3f980e427a199ebba272_JaffaCakes118

Files

017cc51722ca3f980e427a199ebba272_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1e55354da081e1739eac5025201f013d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
LoadLibraryA
GetVersion
CloseHandle
lstrcatA
GetCommandLineA

msvcrt

_initterm
__getmainargs
_XcptFilter
__p__commode
memmove
__set_app_type
wcstoul
__p__fmode
_adjust_fdiv
__setusermatherr
wcslen
wcschr
rand
__CxxFrameHandler
_exit
exit
_except_handler3
_acmdln
_c_exit

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 451B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1018KB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ