16b5f63792f05904ec91dca9d8c6f0e8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16b5f63792f05904ec91dca9d8c6f0e8_JaffaCakes118
Size

3.2MB
MD5

16b5f63792f05904ec91dca9d8c6f0e8
SHA1

3d69ac47626592452f61e5b43bc32c8e1509e66a
SHA256

b470df5cb5222b968f95238b5f693f4f4b4979c9b2d776fccfacc6c785aeda3f
SHA512

55d22d8ba5590ebf140e060bc3e47f06f2079e99044240af946da7f7eee592d5d53a13d87ff15aaec82b5e66e1ec3a818bc0c63946f19d4fe1a3e96bce9e0c0e
SSDEEP

49152:JCWGpmSpLg+twOq/C11Wzb1BslfSn0EmgukteXuByElC6YusUw:JqVpLgRK11WktW0EqkoXCVlC6Yus1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16b5f63792f05904ec91dca9d8c6f0e8_JaffaCakes118

Files

16b5f63792f05904ec91dca9d8c6f0e8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

46084168b412e051097ae39c055c9320

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
SetLastError
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
MapViewOfFileEx
CloseHandle
MapViewOfFile
CreateFileMappingW
ExitProcess
FormatMessageA
SetEnvironmentVariableW
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW

user32

MessageBoxA
wsprintfW

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 616KB - Virtual size: 614KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ