1a6175c567915b8145922f9f2b431643_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a6175c567915b8145922f9f2b431643_JaffaCakes118
Size

16KB
MD5

1a6175c567915b8145922f9f2b431643
SHA1

519dd98e608488e396512ac6b9b87f73177f8e39
SHA256

1c5101c339f8349fa5ef4656ca9da6a4c4b37712a4025f3e738029e3836cc826
SHA512

1c07ab3fa9d623a753f7e3e564a5fb6cca32885f7f17948d868bbd53880cb5a1bd6d309a616294c7aa2cf3ebad7f92d80aadd9255ecd45b09b76a4d3171658ba
SSDEEP

96:q3nlPZPYYRZ3bPSO77aVUzaSA9oCW4+T:EqYXjbjzaS0oC9+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a6175c567915b8145922f9f2b431643_JaffaCakes118

Files

1a6175c567915b8145922f9f2b431643_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f1b55db71a6a1cd2e770b723bf4d45dc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetProcAddress
LoadLibraryA
CloseHandle
WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
OpenProcess
Sleep
WinExec
GetWindowsDirectoryA
VirtualProtectEx
GetCurrentProcess
RtlUnwind

user32

FindWindowA
GetWindowThreadProcessId

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 514B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE