16cc5154496c0c380728c9163c94d0a9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16cc5154496c0c380728c9163c94d0a9_JaffaCakes118
Size

6KB
MD5

16cc5154496c0c380728c9163c94d0a9
SHA1

11493fbabc51d819825807f72d4f88373bd6e797
SHA256

36bf7dabf567ffd33d704ce1068e0da900986a9f49987370013c1d6d3b66dfa2
SHA512

3dbcfd46cc3ca8ddb04f8a12d11e68b71bc3e7b92b9688d06a823eb4a91905bad136b0a48d6185c6dbd3bfce15658f2d35ca457d7e61c349c372b375245e51a0
SSDEEP

48:ayPNlyAa4djAQfo330waHjSASAMlwf9AvcU46zaOzSkuOiESL5oDvmBrVAvC/jeN:LM4djLPuASjwyUU7g958u9VQC5rnq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16cc5154496c0c380728c9163c94d0a9_JaffaCakes118

Files

16cc5154496c0c380728c9163c94d0a9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a6678c9bc051822296edddc6800d4acd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenW
OpenProcess
GlobalFree
GlobalAlloc
lstrcmpiA
WriteFile
LockResource
CreateFileA
LoadResource
SizeofResource
FindResourceA
GetCommandLineA
CreateProcessA
ExitProcess
MoveFileExA
DeleteFileA
lstrcatA
CopyFileA
GetTempFileNameA
GetTempPathA
GetModuleFileNameA

user32

wsprintfW

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ