0549f2de608b1456fac2f9db106ee00c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0549f2de608b1456fac2f9db106ee00c_JaffaCakes118
Size

178KB
MD5

0549f2de608b1456fac2f9db106ee00c
SHA1

50289757a03457cf4babc2e76496c192b3d15138
SHA256

c0844be8b1045fcf68ced22faae64165f511ebbb6972d3c93b8f57cf01adba49
SHA512

646652b800bcec62794154810856c6996e474a4878eeee3ca1a654413008e7ee6d110b7ce4a8f8299a13e92f9995877f7653705e9afbdf22376b2b19e07c084d
SSDEEP

3072:/ZWBQ7yYzcFp1+d2mbVR10jxDQDV4yQ1q5q3RCYUnsLofl2vLsR3x353uQtt4BTg:/ZWBY1C+d2AI9DQDfQ1hUnWofl2YR3h5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0549f2de608b1456fac2f9db106ee00c_JaffaCakes118

Files

0549f2de608b1456fac2f9db106ee00c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7f56624f3ca3d9551d04cf7ef8b9b976

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memcpy
fopen
fseek
fclose
strlen
memmove

kernel32

GetModuleHandleA
HeapCreate
CloseHandle
HeapDestroy
ExitProcess
Sleep
CreateThread
FreeLibrary
HeapAlloc
HeapFree
InitializeCriticalSection
EnterCriticalSection
HeapReAlloc
LeaveCriticalSection
TlsGetValue
TlsSetValue
TlsAlloc
WaitForMultipleObjects
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
ReleaseSemaphore

user32

CallWindowProcA

wsock32

closesocket
WSACleanup
WSAStartup

Sections

.code
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_WRITE

..
Size: 512B - Virtual size: 3B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zaer
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ