419b49bb1aa21dae27891ab75816d307_JaffaCakes118 | Triage

Sharing

General

Target

419b49bb1aa21dae27891ab75816d307_JaffaCakes118
Size

22KB
MD5

419b49bb1aa21dae27891ab75816d307
SHA1

6c0ad6c2c16f22c9ab3f5741b94f61a86e89170f
SHA256

bb1a5935d8e1556589844145706d9162c79ca03fa167ae5aefb43060db2218a5
SHA512

47691d8c3cfa1423cb4a5f35f81399da182a653b7ccc03b360146b15a1687f7e844cc9e1c2b093a3a41eb4e09b6df4b46455c85728f7dc83b3951ae3d5d8d1d6
SSDEEP

192:IfIo0KSSd8Us8SkRQnRIDIpFU2SRST5n6FHh1NGkZTKmslFQ6t8GeO82pQ:vB8BRSRIIU2SRST54Hh1NGkBsle6KD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
419b49bb1aa21dae27891ab75816d307_JaffaCakes118

Files

419b49bb1aa21dae27891ab75816d307_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e9b4cef3f40a98997cf5e2c850f03f67

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
SetLastError
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
MapViewOfFileEx
CloseHandle
MapViewOfFile
CreateFileMappingW
ExitProcess
FormatMessageA
SetEnvironmentVariableW
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW

user32

MessageBoxA
wsprintfW

ntdll

LdrLoadDll
LdrGetProcedureAddress

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ