084faac07589be1dab76aa04c367c3a2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

084faac07589be1dab76aa04c367c3a2_JaffaCakes118
Size

800KB
MD5

084faac07589be1dab76aa04c367c3a2
SHA1

b25d46aeda73a9369af61112f4bb13693e185bfd
SHA256

0c0d22857e24901082648b302ef0e809dda9f41fe49107bd3363533d66bf4938
SHA512

5f3b4be758b9c0b2dd4866dac6c6408ce2ac90d378edebda28ba434297146304946383ebf5637b2681dc9c2c4a487e0a2e9414e7a84a14a360c8be24e9849389
SSDEEP

12288:TDbSCMGwylzyqFAaBm5aKFXstWN6LkbpXIGCWiB9jnzhZidFkxzrq:TDWCGoWDJ6XyYBW+j7idp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
084faac07589be1dab76aa04c367c3a2_JaffaCakes118

Files

084faac07589be1dab76aa04c367c3a2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

35e5791e678c630494da506925c7f32d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalReAlloc
GetTempPathA
GlobalAlloc
CloseHandle
GlobalFree
WriteFile
GetFileType
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
CreateProcessA
lstrlenA
ExitProcess
DeleteFileA
GetExitCodeProcess
Sleep
lstrcmpA
GetCommandLineA
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
GetLocalTime
SetFilePointer
FormatMessageA
GetLastError
GetTickCount
ReadFile
GetFileSize

user32

MessageBoxA
CharLowerA
wsprintfA

shell32

ShellExecuteExA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 788KB - Virtual size: 787KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ