42f47b6e6974c06e3855da963b1559c1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42f47b6e6974c06e3855da963b1559c1_JaffaCakes118
Size

90KB
MD5

42f47b6e6974c06e3855da963b1559c1
SHA1

58a0483815142bc22eb036bd5ef4823a178b1235
SHA256

721ed4bf8990d1c3bc777520b3b2ee10590727f77a53a0928ad9c857acae3f0c
SHA512

b166c0d132d015671c6461bf919234fdce232c1b6ccdeda6f6819683ee8d72412c859a856e16bd86bb1887324e3c572fe02a2a452c1bcf103cb27fb36a383e55
SSDEEP

1536:Gl+GsKWCO1uAHHCBR8Ejz1eNOwzTlNz83ds3IG:Gl+GsKWCO/HiUEPwnjv3z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42f47b6e6974c06e3855da963b1559c1_JaffaCakes118

Files

42f47b6e6974c06e3855da963b1559c1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

82f94e5cf0fe2d0691a99f85dda04c57

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

pdb.pdb

Imports

kernel32

OpenProcess
GetCurrentProcessId
lstrcmpA
MulDiv
LocalFree
Sleep
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
TerminateThread
WaitForSingleObject
CreateThread
CloseHandle
GetLocaleInfoA
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
HeapAlloc
GetProcessHeap
HeapFree
ReadConsoleInputA
HeapValidate

msvcrt

memset

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ