57769323296aa906a3932e0e58d1875f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

57769323296aa906a3932e0e58d1875f_JaffaCakes118
Size

187KB
MD5

57769323296aa906a3932e0e58d1875f
SHA1

ed8b104dd3787eb5eb67b317ffc4f15a0a2bb4e4
SHA256

c01c50cf0a19acc122667126476979136d192192749ae250a14b6d6dd8db5fe9
SHA512

90f2f6d6c4e5813e9e72623674cabe50a793442d51804450994093dbab4f909e5e50d744804f7a49e42e08f40a70645e60ee64b04f13ab3db67d230f1c66ef9c
SSDEEP

3072:8T0CHmxjTtdZE6I273BtW9uFZvXm4zm5RFCh+Rz7NdO3rJRWljmlnKrs+Evdqb4E:8THQxt0XIm5RFCh+Rz7NdO3rJRWljmlp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57769323296aa906a3932e0e58d1875f_JaffaCakes118

Files

57769323296aa906a3932e0e58d1875f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

244aaaf15145fe93c03624353e75ce35

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Return\File\Allow\Execute.exe

Imports

msvcrt

isalpha
_controlfp
__set_app_type
atoi
__p__fmode
__p__commode
_amsg_exit
_initterm
_ismbblead
_XcptFilter
_exit
_cexit
__setusermatherr
__getmainargs
wcsncmp
fgets
strrchr
gets

kernel32

CreateFileMappingW
GetFileTime
HeapLock
CreateSemaphoreW
GetFileAttributesExW
GetNumberFormatW
FormatMessageW
GlobalDeleteAtom
GetCommModemStatus
ClearCommError
CreateFileW
VirtualProtect

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ