45b556503b7656877468eb0bfbe9dbef_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

45b556503b7656877468eb0bfbe9dbef_JaffaCakes118
Size

123KB
MD5

45b556503b7656877468eb0bfbe9dbef
SHA1

cfd440c12f5e2a8691018255efdbfb248bad8d2a
SHA256

a5a2f153c993361f02a98cfee34ba68473d1a4cc3629ed0a25b370299f4a0132
SHA512

7da0612d83f705d394694b2cd10ac8c39a93171abe07e94c5c32c999bd19a0ceb8922c8907b99ef92268a924a1ff09637058bc2cc8e740bf2b82e1f40b44c5ef
SSDEEP

3072:edPdTvig3QYDOHIGefUn2RtacNiRMJGAJDQwGNVQiYN:edPdTag3QYDOHIGefVFN26GAtQwGN5I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45b556503b7656877468eb0bfbe9dbef_JaffaCakes118

Files

45b556503b7656877468eb0bfbe9dbef_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e8e6a7f2865610045ae8d4a245040cd0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
CloseHandle
lstrcmpiA
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryA
ExitProcess
ReadFile
SetFilePointer
CreateFileA
FreeResource
WriteFile
SizeofResource
LoadResource
FindResourceA
GetModuleHandleA
ResumeThread
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
WinExec
GetLastError
CreateMutexA
Sleep
CreateThread
GetCurrentThreadId
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strchr
_except_handler3
malloc
realloc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ