21c4d82982b38fbb69b9d6319aeaffb3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

21c4d82982b38fbb69b9d6319aeaffb3_JaffaCakes118
Size

5KB
MD5

21c4d82982b38fbb69b9d6319aeaffb3
SHA1

50a09fe5133b4c17fed416753927be07f131defe
SHA256

b156a8792e40edc720ffbcabc3d2be5857309f343a75325c7093e910c4b60afa
SHA512

744c5cc09eee170bc0d03dabc059061f149675b3b7d57e4d1d5b01ca9ef48aba59ad86e345bbe24bb8a6357bd3c7238a0f379e203b9a917d960abb2b4ad7b1b7
SSDEEP

96:9tzDg7VAePmYG8broSUb7ZdY22JE4fmhM:bzDg7yeOYdrxUPHLwhfGM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21c4d82982b38fbb69b9d6319aeaffb3_JaffaCakes118

Files

21c4d82982b38fbb69b9d6319aeaffb3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a9f544e558731907efd89d1e721e5e41

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext
LoadResource
LockResource
OutputDebugStringA
ResumeThread
RtlZeroMemory
SetThreadContext
SizeofResource
VirtualAllocEx
WriteProcessMemory
lstrlenA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ