f6b3a76adc8cbb4b669731091754fa13_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6b3a76adc8cbb4b669731091754fa13_JaffaCakes118
Size

53KB
MD5

f6b3a76adc8cbb4b669731091754fa13
SHA1

c665e9ff10d913df3e01f2d2507e01d93576ded5
SHA256

7d7ccf53a9faa1cdbad94e1150f1dc1aa5a5c04113735ff67389bee4b743d053
SHA512

bd52002e835aad6fa05854693fc0947566384e4f78d2d0dd52048c45ae222c8aa5b85024a0990cfe18b2d3175794d5f281b584da057fd01bd8c5cde74e17147e
SSDEEP

1536:wgkRIHqzVtHbXLIb3Qm6HblCVT/UmpETW:GmuHjLIE5YV/UmpEq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6b3a76adc8cbb4b669731091754fa13_JaffaCakes118

Files

f6b3a76adc8cbb4b669731091754fa13_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d7ddde62f42c89fbabb7dbe6d4656cfd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetFileSize
ReadFile
SetFilePointer
CreateFileA
TerminateProcess
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
GetThreadContext
CreateProcessA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
HeapAlloc
GetProcessHeap

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE