410aafa5a051a53b404ba8c9b633d0c2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

410aafa5a051a53b404ba8c9b633d0c2_JaffaCakes118
Size

85KB
MD5

410aafa5a051a53b404ba8c9b633d0c2
SHA1

c4fd34642c374db8622aea3bc43487272505d03d
SHA256

e46c13554654ecb493eb6068df40e9323616b3ce4141016ea58f9656f583ede6
SHA512

a9e5b57f1955071eb1032bfdb60e2e02afb38c5bb84e3815058ad238f7a131a2c0f731fc92405b615b6e5d6e531ffc556565308ae81e61c0479217cda315c465
SSDEEP

1536:b6bBvuGBig3htlTg1J/d+WevUCxE/NWhn2Vr6o0rGPxbN+ZDBTbcZVhcYSCdj/Lg:ubBvuGYglaO8K296oFxAczSChg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
410aafa5a051a53b404ba8c9b633d0c2_JaffaCakes118

Files

410aafa5a051a53b404ba8c9b633d0c2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f88aaec97059cb1cc4f5d649ce81b6a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

exit
__p__commode
fwrite
_except_handler3
fprintf
free
malloc
fopen
_acmdln
strcmp
__getmainargs
cos
_XcptFilter
__setusermatherr
__p__fmode
_adjust_fdiv
fclose
_exit
_initterm
getenv

kernel32

VirtualProtect
GetStartupInfoA
GetModuleHandleW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 582B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ