3916ebb138a82528bc7551c806a9776a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3916ebb138a82528bc7551c806a9776a_JaffaCakes118
Size

1.1MB
MD5

3916ebb138a82528bc7551c806a9776a
SHA1

ec388e23d8e798aa91c4ecac8f0d4be2c0efee10
SHA256

564a693b25cbec14885bfc7d2a02754351372a79e778973728755ebf5b530d88
SHA512

8e88d1f7017b2162d4172b23a67e9ce6f58b0098b569178e248a4ba20820cc6091ad9f72c98adb752e7eac370ef304141913b6cd42e42d9fd2c4f170b516fc4d
SSDEEP

24576:cvWemcHS6h9gJLn+bg2AAmHngprHQ5BxTMI:ogcHbtWHgprQLpMI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3916ebb138a82528bc7551c806a9776a_JaffaCakes118

Files

3916ebb138a82528bc7551c806a9776a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

93cd99753d7e990639202b516f015590

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
GetCurrentThread
GetVersion
GetCurrentProcessId
GetSystemDefaultLangID
GetUserDefaultLangID
GetSystemDefaultLCID
GetCurrentProcess
GetCommandLineA
GetLastError
GetModuleHandleA
GetUserDefaultLCID
HeapAlloc
GetProcessHeap
InterlockedIncrement
Sleep
GetStringTypeW
HeapReAlloc
GetProcAddress
FindFirstFileW
FreeEnvironmentStringsW
IsDebuggerPresent
WriteFile
InterlockedExchange
GetCurrentThreadId
SetEnvironmentVariableA
GetModuleFileNameW
LoadLibraryA
SetHandleCount
HeapDestroy
TlsGetValue

Sections

.text
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 902B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 784KB - Virtual size: 783KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ