2973553173caa41498ba4cfad9050695_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2973553173caa41498ba4cfad9050695_JaffaCakes118
Size

110KB
MD5

2973553173caa41498ba4cfad9050695
SHA1

c4abfa137386d4d71b9a6b3ba08106158810e05d
SHA256

0272af52f06eac34b14f0c3205b5c48b883e46f73fe68e355b96fd96c7699d84
SHA512

165ffc040ab9fefcc7894919a74be5aec2907762f1ddc9c3b48acc74b42b2d376215a5f254380d73b6ce118f066afa7fecb0fc8a3d5fcd50135782caba70567d
SSDEEP

1536:09bqDPxw0feVLhnNmnlPef6L4gky9OUed2Eg4g/jSaTLsbi+bg/OsGYX5MgJlhfq:Wb4xF8nN4GiL47r3Y/j6gDhs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2973553173caa41498ba4cfad9050695_JaffaCakes118

Files

2973553173caa41498ba4cfad9050695_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ab95fa48da978e704d350de5d432281b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__commode
_initterm
__setusermatherr
free
__p__fmode
_XcptFilter
_exit
_controlfp
__p___initenv
__getmainargs
calloc
_except_handler3
_adjust_fdiv
__set_app_type

kernel32

InterlockedExchange
Sleep
lstrcmpiW
SetHandleCount
FileTimeToDosDateTime
GetProcessHeap
GetTempPathW
CopyFileA
InterlockedDecrement
GetVersionExW
GetProcAddress
GetCommandLineW
GetConsoleMode
GetModuleFileNameW
GetModuleFileNameA
VirtualProtectEx
GetModuleHandleW

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ