ec00ae35a690e437b653f63678dee8f8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ec00ae35a690e437b653f63678dee8f8_JaffaCakes118
Size

104KB
MD5

ec00ae35a690e437b653f63678dee8f8
SHA1

c2b4aff59081f44414195819d8bb3467180158b6
SHA256

89b1efc5d1dd8696c87a04cf26c9faf32f1bb5af9ee62486f571c1cab13780b5
SHA512

df5f9c9bdfbd7caddd69db525410319ca2ff2538ca553e6d3933c886eb1954e84d8b4268768b79f4f32469e25233670d5b8103cea8c5e7c91e36980912fd5023
SSDEEP

3072:5VrT9AWdhdUXQhTmCjVrEzwkmwRLtJJPjgKwv3/JA:5t9hdhRd5rTkbRLtJJkK+PC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec00ae35a690e437b653f63678dee8f8_JaffaCakes118

Files

ec00ae35a690e437b653f63678dee8f8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6d0ea05765980c4408abc7579397e940

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetVolumeInformationA
GetSystemDirectoryA
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateFileA
GetTickCount
GetCurrentProcessId
GetTempPathA
SetEnvironmentVariableA
ExitThread
GetCommandLineA

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE