0eb6395a0952a52bceff0d969d580d8e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0eb6395a0952a52bceff0d969d580d8e_JaffaCakes118
Size

303KB
MD5

0eb6395a0952a52bceff0d969d580d8e
SHA1

e5e4d2702b9ded0010f508361caced1bf5f59c32
SHA256

60f1a5c175c82f017472279e7ad43d21f13ecc87eed43a8a0a120417c76ac3ec
SHA512

f656d80f0314c1f88c2fed7bbc2e0bdb2be8f27ab3f8d915600dac612c1c690564b9f5ed3941828fe96c08a33bdf5dfb85d9c07d962a8ccee7fb0f179d784ad6
SSDEEP

6144:bFcq02eiM3aNTN2Tc9AePhVFfI92TfbCDikuEL4eK34EBO5q+cf6:bN0283a50TDePhY9W+DiEL4eK1/K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0eb6395a0952a52bceff0d969d580d8e_JaffaCakes118

Files

0eb6395a0952a52bceff0d969d580d8e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2f469e28d762c4b75f504f50b355e952

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA
SHGetSpecialFolderPathA

kernel32

ExitProcess
lstrcpyA
lstrcatA
WriteFile
SizeofResource
RtlZeroMemory
LockResource
LoadResource
GetTickCount
GetTempPathA
GetModuleHandleA
GetModuleFileNameA
CloseHandle
CreateFileA
FindResourceA
GetCurrentDirectoryA

Sections

.text
Size: 1024B - Virtual size: 766B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 546B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE