1c482b1d9621da09ccd83605ea4fa227_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1c482b1d9621da09ccd83605ea4fa227_JaffaCakes118
Size

3KB
MD5

1c482b1d9621da09ccd83605ea4fa227
SHA1

2b657637d2cf5836eb19b443aaded59668d77863
SHA256

8c0b8b5676a75f15c41e85d4cead8ffe336112a1096a9cb814d0288697272435
SHA512

779b37bf17e85fdfbe8c55dada2a5a33de46f4fe5f2d9a006dfee0fdc2f0337507b7eef94e0fc46420d92cc948992080c2323615e7491fde19e5ef90c519019a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c482b1d9621da09ccd83605ea4fa227_JaffaCakes118

Files

1c482b1d9621da09ccd83605ea4fa227_JaffaCakes118
.exe windows:4 windows x86 arch:x86

af159a405b109ceefaeecd5029324c87

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToFileA

kernel32

GetSystemDirectoryA
lstrcatA
CloseHandle
CreateProcessA
CreateRemoteThread
ExitProcess
ExitThread
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
LoadLibraryA
OpenProcess
Sleep
VirtualAllocEx
WaitForSingleObject
WinExec
WriteProcessMemory

Sections

.text
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE