JaffaCakes118_7e3e9970e809be4c60529f14c838313e | Triage

Sharing

General

Target

JaffaCakes118_7e3e9970e809be4c60529f14c838313e
Size

346KB
MD5

7e3e9970e809be4c60529f14c838313e
SHA1

474f0f26deab4cee1652dac440ab6e7e3a8358a2
SHA256

9b004136e63dfe45c06aa3900d8e3c110ab54622573d233a344b53f6cdce4ace
SHA512

952a4d560417c14a39d92e5318fe8cee3331a68a02dfbdc57c08fedf5fb4c93305e32609784c7fe1b6891f7d5a502cfd333cd0a4cd5edbbb6297516062e70f3e
SSDEEP

6144:SS2TMoVaGR251kwfjNcweNbl+zb2dSllNFwXscphU+3:SSiMopR2LXiweNbHINcA6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_7e3e9970e809be4c60529f14c838313e

Files

JaffaCakes118_7e3e9970e809be4c60529f14c838313e
.exe windows:4 windows x86 arch:x86

1dbe3555e04206148ad13c8956bc9b18

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3
atoi
memcpy
memset
??2@YAPAXI@Z
strtok
getenv
??3@YAXPAX@Z

kernel32

GetStartupInfoA
lstrcmpiA
GetCurrentProcess
IsDebuggerPresent
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetModuleFileNameA
lstrcpyA
lstrcmpA
CreateMutexA
GetLastError
lstrcatA
CreateThread
CreateFileA
WriteFile
CloseHandle
WaitForSingleObject
lstrlenA
ExitProcess

advapi32

AllocateAndInitializeSid
CheckTokenMembership
FreeSid

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ