1858eaaec31b0a6446109832bf467fb0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1858eaaec31b0a6446109832bf467fb0_JaffaCakes118
Size

320KB
MD5

1858eaaec31b0a6446109832bf467fb0
SHA1

79fb36e58b74011d4dfee58e00964bea7be4c28d
SHA256

f340e35b2cbe9bd802f1c3fa2c6ad00c5fa9f618f8ba571d4c3d163dff634a93
SHA512

971b0c77f1fa38c9987e5c1f8c8061485caacdc477107c3e3926b3eeb320477d14f149be8baaad0c526d2acd58690097b1f8f892e37139f1d967de5164dcc4cf
SSDEEP

6144:pWk625Y+cuIf5Fb+P3CBJ9T7DfUU9qS4IQjYFBhMxKsWFNeEByNyq:Uk625Y+cuIfH+P3CRLUeF4gtMkNDeE6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1858eaaec31b0a6446109832bf467fb0_JaffaCakes118

Files

1858eaaec31b0a6446109832bf467fb0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6dd099f94038702fea19812bbce41f87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetProcAddress
GetModuleHandleA
LoadLibraryA
LockResource
VirtualFree
LoadLibraryExW
FreeLibrary
CreateFileA
GetTempFileNameA
GetTempPathA
WriteFile
CloseHandle
GetTickCount
LoadResource
SizeofResource
FindResourceA
ExitProcess
MoveFileExW
MoveFileA
GetCommandLineW

user32

DefWindowProcA
BeginPaint
EndPaint
PostMessageA
PostQuitMessage
SetTimer
RegisterClassExA
LoadStringA
DispatchMessageA
TranslateMessage
GetMessageA
ShowWindow
CreateWindowExA
UpdateWindow

shell32

CommandLineToArgvW
SHGetFolderPathA

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 275KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ