e8566717ef25edb2f56859130690aff7_JaffaCakes118 | Triage

Sharing

General

Target

e8566717ef25edb2f56859130690aff7_JaffaCakes118
Size

7KB
MD5

e8566717ef25edb2f56859130690aff7
SHA1

31aa6ebfa21accf18369b70f60629fb9315a2906
SHA256

3310b8f75c13f2257e43d8aa7fbd6f186eaf4474925cbdffd52648370b68e56b
SHA512

26893acb2ca3ff35638b50cb29d43639dbbeb24bda67e15b840d9f0bff01c0752951810b8ca08bc9dcefbbd4272a89687e0dd7d92002e58449941876baabe682
SSDEEP

48:ytPzd54RfoERjUrngz3CrfUjyFj2ZKvbKVlxVx/BVglFQKgSDun4oP:6RCAEkgz3CUOj81r7/kUvn4oP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e8566717ef25edb2f56859130690aff7_JaffaCakes118

Files

e8566717ef25edb2f56859130690aff7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

06eba18b17985b5e09930d42fab7cc64

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateRemoteThread
ExitProcess
ExitThread
GetModuleHandleA
GetSystemDirectoryA
GetWindowsDirectoryA
LoadLibraryA
OpenProcess
Sleep
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
lstrcatA

user32

GetWindowThreadProcessId
FindWindowA

urlmon

URLDownloadToFileA

shell32

ShellExecuteA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE