30398d3a0f3bdd9420a216be9fde5b3b_JaffaCakes118 | Triage

Sharing

General

Target

30398d3a0f3bdd9420a216be9fde5b3b_JaffaCakes118
Size

696KB
MD5

30398d3a0f3bdd9420a216be9fde5b3b
SHA1

71d14e96daa0e7e82024f236593530d968ea92ca
SHA256

ee17b445a896138ecb1292b7227315e8bb1ed0ce1fed902dc1bf0a1c59adb5fa
SHA512

0c9448ee1d5f645157a34979803f06327342ec98b60b7d14db39004c0c9cd1cde09ac24f72fea1c538b965656bd902a97d567bc28e4b36bc4918b87fbf72a34d
SSDEEP

12288:xcUk9EIdjJ28OssuZWj1W1v2xehk0Xrj1kRiWuoe6p2d/NegBKI:xc9Ldl28OssuZkW1v2xwk0bZkEWJrGeK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30398d3a0f3bdd9420a216be9fde5b3b_JaffaCakes118

Files

30398d3a0f3bdd9420a216be9fde5b3b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f75168d64597984c5fdae1cdd5162476

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetVersion
GetFileSize
LocalAlloc
GetCommandLineA
LocalFree
GetModuleHandleA
GetStartupInfoA
Sleep
lstrlenA
lstrcpyA
CreateEventA
GetTickCount

msvcrt

_exit
exit
wcstoul
memmove
_c_exit
__p__commode
_XcptFilter
__CxxFrameHandler

gdi32

GetObjectA
MoveToEx
GetTextColor
GetStockObject
GetTextExtentPoint32A
CreateFontIndirectA
BitBlt
ExtTextOutA
GetBkColor
DeleteObject
GetPixel
SetBkMode
SelectObject

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 673KB - Virtual size: 676KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 724KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ