152a20d21d448dd9042f28eaf4f25324_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

152a20d21d448dd9042f28eaf4f25324_JaffaCakes118
Size

3KB
MD5

152a20d21d448dd9042f28eaf4f25324
SHA1

fe8ca6f36d70f7c48abb81053f424b392b4928c6
SHA256

8b225d98b601387186fa7add67e84d84f6a64273c2e7ba28ca1938e2fe24675d
SHA512

62fa71fea4d5cc7acad1887998f2710e1b74240baf23b205d0d16a5fd17c4acbe4f7799987a7916b4f420cd68c81e9480dbda84b221372a85982905ce451ad00

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
152a20d21d448dd9042f28eaf4f25324_JaffaCakes118

Files

152a20d21d448dd9042f28eaf4f25324_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4987bb80a2e0edb00dcec12084601a4c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateFileA
CreateProcessA
CreateThread
ExitProcess
ExitThread
GetProcAddress
GetThreadContext
LoadLibraryA
OpenProcess
ReadProcessMemory
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlFillMemory
RtlMoveMemory
RtlUnwind
RtlZeroMemory
Sleep
SuspendThread
TerminateProcess
VerSetConditionMask
VirtualAlloc
VirtualProtectEx
WriteProcessMemory

user32

MessageBoxA
wsprintfW
wsprintfA

ntdll

ZwQueryInformationProcess

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 902B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE