161eaed84fb22f33c3cb3c57f00f37f4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

161eaed84fb22f33c3cb3c57f00f37f4_JaffaCakes118
Size

194KB
MD5

161eaed84fb22f33c3cb3c57f00f37f4
SHA1

b6ce06c674a72c27970dde223fb378a5afc5182f
SHA256

add46ba519ac3e0139f82779647de5932255cb2f1d96826505f9e3f4a159610f
SHA512

338e69b0dc9459c901dd693af86713ddf36ed6f82bfa11a1d5abf30dd8a1aa955b1794886f3dd712534dc91354f73318ae35949c5786edd5d7fd3d0d9220ecd1
SSDEEP

3072:kU5itG6xPKR9G8uSTKC0lmdvE8l2fHOrVVAJJSQxWRmy+o4MMQXbVsuZsZ/O:k4itG67DSeCiKIHOrVcxxWhfDLVGG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
161eaed84fb22f33c3cb3c57f00f37f4_JaffaCakes118

Files

161eaed84fb22f33c3cb3c57f00f37f4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cb8c9e3d83c049f211bb9ab3e6e9648e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
GetCurrentProcess
SetEnvironmentVariableA
InterlockedDecrement
GetEnvironmentStrings
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
GetTickCount
DeleteFileA
CloseHandle
DuplicateHandle
SizeofResource
FreeEnvironmentStringsA
GetOEMCP
LockResource
FindResourceA
GetEnvironmentVariableA
GetCurrentThreadId
FormatMessageA
GetModuleHandleA

user32

LoadStringA
LoadCursorA

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 734B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ