437c00b489c43d24a65287c46fb52123_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

437c00b489c43d24a65287c46fb52123_JaffaCakes118
Size

256KB
MD5

437c00b489c43d24a65287c46fb52123
SHA1

9048a10ffe8f3b5103e408c58b0dc4c66ece8e70
SHA256

24cd695a0372bb5e6f7212e3ce271c3c8b32c6b6e1abde9c1f1368ee322e443c
SHA512

bb29d042962f797bddbdc6e2c0dc8efc64516346499721ff27400ceaa3122652f1973ac2a22e26c02d4fa09b28a303f2f3991230295a6a655b59b5428c3eb021
SSDEEP

6144:5kDMPUO9npDtz0GHo/9H4SW25GvdYCJ+aJN:mD09/IGHo/t4e5GvmCJ+aJN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
437c00b489c43d24a65287c46fb52123_JaffaCakes118

Files

437c00b489c43d24a65287c46fb52123_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a80486b5a6062d16924fc5220505854f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comdlg32

GetSaveFileNameA
GetFileTitleA

msvcrt

sin
memcpy
exit
memset
malloc
mbstowcs
tolower
wcscspn
acos

kernel32

GetModuleHandleA
ExitThread
IsBadReadPtr
LoadLibraryA
GetModuleHandleW
lstrlenW
LoadLibraryExA
VirtualAllocEx
GetLastError
GetOEMCP
ExitProcess
GetProcAddress

version

GetFileVersionInfoA

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 711B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 4KB - Virtual size: 519B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ddata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ