2bc19af9eb7f7fe3c54c59104b938dc7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2bc19af9eb7f7fe3c54c59104b938dc7_JaffaCakes118
Size

16KB
MD5

2bc19af9eb7f7fe3c54c59104b938dc7
SHA1

87ce8ac724abf2cfb047891094b089c3dffd8a64
SHA256

8f3798713547fc175b2821f1854564b1866156237d0c25f2492392170bda8b28
SHA512

4f07053d7f4ac8ae2079423e1d64cc9901b6d65743f87d9624480770360dd6523c3d9082d8b021ab737b921655db41109716149bfcdb16766dbc0efcf338f9b0
SSDEEP

48:qZDOoWzZY+qg8Rc77aRC6uDqBpK7DgjEmmPT:++V8S77aZyqyAEZb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bc19af9eb7f7fe3c54c59104b938dc7_JaffaCakes118

Files

2bc19af9eb7f7fe3c54c59104b938dc7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e6589b03e80793c6a8a16d7a1fdead99

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetProcAddress
LoadLibraryA
CloseHandle
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
OpenProcess
Sleep
WinExec
GetWindowsDirectoryA

user32

FindWindowA
GetWindowThreadProcessId

Sections

.text
Size: 4KB - Virtual size: 702B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE