11176a62468109d79ee9e0054ad0822f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

11176a62468109d79ee9e0054ad0822f_JaffaCakes118
Size

7.6MB
MD5

11176a62468109d79ee9e0054ad0822f
SHA1

f9316e1918e1d899214bce4d9670a6b7079ef49e
SHA256

6b209f45276d75fe1950356da20f07dc0777e7b4c3e4b6a7aebc32d66548935f
SHA512

cf00958daed7d1d593fba66f0dec78eaa6449bc5914ecc9728bcd0be87ed3bae15945ffac70c6afc07cefb634cd6101f8aec33d9576c954578566adebfe18bb4
SSDEEP

196608:UFa6McQ/8CmSBHHLOz/L5fkFumMW3XFrXCkZ:UY6UkC5BSLL5fkFunW3hB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11176a62468109d79ee9e0054ad0822f_JaffaCakes118

Files

11176a62468109d79ee9e0054ad0822f_JaffaCakes118
.exe windows:0 windows x86 arch:x86

6ad7439051add5539ec1e212482847a1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
DeleteFileW
SetPriorityClass
GetCurrentProcess
lstrcpyW
GetCommandLineW
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ