e784597494d5f943787ab5a8ccf726c7_JaffaCakes118 | Triage

Sharing

General

Target

e784597494d5f943787ab5a8ccf726c7_JaffaCakes118
Size

27KB
MD5

e784597494d5f943787ab5a8ccf726c7
SHA1

f8cff359e723678b797fe096daff72c0f13b4e71
SHA256

71f45dcd5e1362b5648f5aad65342b60e858e5132d1449fe8ed8b1b3065ee8f4
SHA512

6a41bb4f172311f84741708b74485fca034afd429c2d8c64d961efa244004a10a5309848974cf85368029831216c4a89756bbee4add3fbac01916e816d4b15d7
SSDEEP

768:IyYdMCPMbvso5tQ65c0dVdYCIbYFp5fcxwXz:mdMCPMbvso5a5YcS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e784597494d5f943787ab5a8ccf726c7_JaffaCakes118

Files

e784597494d5f943787ab5a8ccf726c7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7345f9497130be252852f565608edfb2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetTickCount
GetTempPathA
Sleep
GetCurrentThreadId
ExitProcess
GetProcAddress
CloseHandle
WriteFile
CreateFileA
GetModuleFileNameA
LockResource
SizeofResource
LoadResource
FindResourceA
GetModuleHandleA

user32

PeekMessageA
PostThreadMessageA
wsprintfA

Sections

.text
Size: 1024B - Virtual size: 663B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 670B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

exex
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ