14ee1c5456e56780aff1e9faeba38199_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14ee1c5456e56780aff1e9faeba38199_JaffaCakes118
Size

45KB
MD5

14ee1c5456e56780aff1e9faeba38199
SHA1

c8981f94ce489eddc29504a0f4365061f724a0ab
SHA256

d0945a301c680355842a1d5aa0f7b7b69afb1478cb8ea1d03ff1319dd0cca92a
SHA512

119605c3b245e97e199c6b2fa47ec0a7adad45fcdbc8bd71657fce882c5388edf3364405dbcdb9b08ebce7ab5e1c323018a430f97364ca660ae39e8ebca10098
SSDEEP

768:jQ/RS8YzXB+VVgz7aSPReR/ZC95/mE2CGWqhZQkAxdHGHd8cBUOpDB4W533EGV/b:jQoFroEz7pp2RC95/YlLQkqmZvpOW5nd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14ee1c5456e56780aff1e9faeba38199_JaffaCakes118

Files

14ee1c5456e56780aff1e9faeba38199_JaffaCakes118
.exe windows:1 windows x86 arch:x86

92009019dee90696f2364d47b68ae436

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessInternalW
CreateFileW
ExitProcess
GetFileSize
GetModuleFileNameW
GetThreadContext
GlobalAlloc
ReadFile
ResumeThread
VirtualAllocEx

ntdll

NtSetContextThread
NtWriteVirtualMemory
ZwUnmapViewOfSection

Sections

.text
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 42B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE