686af4c766cc44369d88bd7b20f01e07_JaffaCakes118 | Triage

Sharing

General

Target

686af4c766cc44369d88bd7b20f01e07_JaffaCakes118
Size

3KB
MD5

686af4c766cc44369d88bd7b20f01e07
SHA1

4ba8b5821f3f8d7d9712c1670641c5762c53bde3
SHA256

01e886231896581c36fa5aba1852bc82abff0736cdfca02a7e48d8d5a23d3773
SHA512

ba21448943567acdf72e5e17985d7fe164f6c56b514a4915dc0114f46ce7be17d6908a4bdfb1dfc731ed5f9195881b309d05a3d40faadc11ae7b5f3a892395ed

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
686af4c766cc44369d88bd7b20f01e07_JaffaCakes118

Files

686af4c766cc44369d88bd7b20f01e07_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9eeefa7f6cdca34a42a6c3913e8fb403

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCommandLineW
GetTempFileNameW
FreeResource
FindResourceW
LoadResource
CreateProcessW
WaitForSingleObject
GetModuleHandleW
GetTickCount
WriteFile
SizeofResource
GetFileAttributesW
GetModuleFileNameW
CreateFileW
lstrlenW
GetTempPathW
LockResource
lstrcatW
CloseHandle

shell32

SHFileOperationW

shlwapi

StrChrW
StrRChrW

msvcrt

??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
free
memmove
memset

Sections

pe
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 656B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ