ec105ec1520dc15135437f79f0eee672_JaffaCakes118 | Triage

Sharing

General

Target

ec105ec1520dc15135437f79f0eee672_JaffaCakes118
Size

10KB
MD5

ec105ec1520dc15135437f79f0eee672
SHA1

e4131e43b29217e372f32cdd4e6aebc81712e402
SHA256

90c35604ab109752cd767df7c85443a9660249ac6934b9341c8d058d0940dd57
SHA512

97ecd2146838dee352106ad7691378fa9acf04e2e4d151181d50ad62b85130b39023cf313097f5585c2c0a7ff7c30579d1520387d264e2bc9bbb2ff51377b437
SSDEEP

96:AA/w7vqtNneZC+MU9aG//3VDdaNuuFVg4iG//BLd0q8Aa4qqNa/QmZf:A4c6nQCm4u3V4NbFVgA3BLdTa4RaQm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec105ec1520dc15135437f79f0eee672_JaffaCakes118

Files

ec105ec1520dc15135437f79f0eee672_JaffaCakes118
.exe windows:4 windows x86 arch:x86

01c36987a9228f9e8485149e8273c4be

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetWindowThreadProcessId
FindWindowA

kernel32

GetSystemDirectoryA
lstrcpyA
lstrcatA
WriteProcessMemory
CloseHandle
CopyFileA
CreateFileA
CreateProcessA
CreateRemoteThread
ExitProcess
FindResourceA
GetCurrentProcess
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetShortPathNameA
GlobalAlloc
GlobalFree
LoadResource
LockResource
OpenProcess
ResumeThread
RtlZeroMemory
SetFileAttributesA
SetPriorityClass
SetThreadPriority
SizeofResource
VirtualAllocEx
WriteFile

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ