181643932227695fe9c476838640a153_JaffaCakes118 | Triage

Sharing

General

Target

181643932227695fe9c476838640a153_JaffaCakes118
Size

146KB
MD5

181643932227695fe9c476838640a153
SHA1

0b0286ec2c2545d28d3bc10e67a02f07162be3ff
SHA256

c4a9538f7ab24a90e703c8427f1e9877fa16958dddf08dd7c4928a19fa4ad651
SHA512

fea1f05fc36e783d9798cd380d0ee5f8fdf292bd634390a2aa6160bba6c9d00f4abd0b5b4148750c00e8e33448bd2eafd2862f3d01ebfd1ec66204219f3be2df
SSDEEP

3072:DQ8cGdhI7cFTcfisy5tnUxJu1+e9vxT8TL++XOQOzC/UJJGE:85IqwVrsy5dUxJu1+EZj+X+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
181643932227695fe9c476838640a153_JaffaCakes118

Files

181643932227695fe9c476838640a153_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fce7809a30096dee5d325be7178490ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetThreadContext
GetTickCount
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SizeofResource
Sleep
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteProcessMemory

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE