fb4c111ddf3fdc6a5b7ffe7073816562_JaffaCakes118 | Triage

Sharing

General

Target

fb4c111ddf3fdc6a5b7ffe7073816562_JaffaCakes118
Size

383KB
MD5

fb4c111ddf3fdc6a5b7ffe7073816562
SHA1

3b027b3dc3357fddc43fd1c2ac5f75e8453c6712
SHA256

45ae919666be18fbb9a86eba7731513b8ba187252392cf68f5846e925955f2c8
SHA512

ecd3cae9f128cc8e43911a93b436c894cbfbc35bee431036aee6bebcd0f4930abc8bc846cde17ac0eb62f90d4418dbdc9317a845ee3a4a694e81596a252d0fc1
SSDEEP

6144:Kmrid57rT9V2kWI3G7smpC3bJ544hI0J4lZWp70BsoH8qEZ+C01k4pdvODymlhkY:Km2v7HT3stpOy/lZWkcJ+CqFODycaC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
fb4c111ddf3fdc6a5b7ffe7073816562_JaffaCakes118

Files

fb4c111ddf3fdc6a5b7ffe7073816562_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1e5d33070fcdbae8f49340ec34a761fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessW
WriteFile
CloseHandle
CreateFileW
GetFileAttributesW
GetTempPathW
ExitProcess
ReadFile
SetFilePointer
GetModuleFileNameW
GetTickCount
HeapAlloc
GetProcessHeap
HeapFree

Sections

.text
Size: 1024B - Virtual size: 798B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 406B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE