f63bfe7cd61018ec611af7f9638046e4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f63bfe7cd61018ec611af7f9638046e4_JaffaCakes118
Size

132KB
MD5

f63bfe7cd61018ec611af7f9638046e4
SHA1

ea3cbd415b3b9d066bb2c88e2d67f129e61bf067
SHA256

df01c0bb2668b634dc45332c0a04d9df4c83b0b970eebb057244a025c1a43831
SHA512

4aaf43aa828525d192affbe28ecf5440726dab676bc700964f6b1001fafd1836974b4f13d4d1a7fae87972df4f7fa384007f8949b0b48966c9e0f12c10654f4a
SSDEEP

1536:zulHL4x65T0UnZ0v7cQ/s4+dccSpFvitqHw910tTocMO5qNc02D9Sfv:zu975g6+v7zPdpzQX0qrO5qNc02xqv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f63bfe7cd61018ec611af7f9638046e4_JaffaCakes118

Files

f63bfe7cd61018ec611af7f9638046e4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

36e1820d27b3e70804a7e91b356b3115

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA
SHGetSpecialFolderPathA

kernel32

CloseHandle
lstrcpyA
lstrcatA
WriteFile
SizeofResource
LockResource
LoadResource
GetModuleHandleA
GetModuleFileNameA
FindResourceA
ExitProcess
CreateFileA

Sections

.text
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 442B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE