485f339305991c20b419d378c6db82d5_JaffaCakes118 | Triage

Sharing

General

Target

485f339305991c20b419d378c6db82d5_JaffaCakes118
Size

192KB
MD5

485f339305991c20b419d378c6db82d5
SHA1

de88a3c1b5e16ddc7da936a72ecda1e09214f649
SHA256

ac7f5471c395af718216a35c3be8bb93896117fd44bc6e2bd6a474c2d0eadc79
SHA512

5f39e771024964ea68f82d94629cd7ad2863f3064474270f0b68ad5513db4c1395e9ea64f32e3976b9fb10f1532c12b4d01b704b85c006308d7e03e5f46507be
SSDEEP

3072:pW65sZlEb4Kf/QxGEcMI5Kn9CPL+riNKyUIW5yyUa6OrgKB:c65sZOb/QxFSKniLBYyq5Sa6SgKB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
485f339305991c20b419d378c6db82d5_JaffaCakes118

Files

485f339305991c20b419d378c6db82d5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8b4cc2be0324264fac1338e1727600aa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
DeleteFileA
lstrcpyA
lstrlenA
GetTempFileNameA
GetTempPathA
GlobalAlloc
ExitProcess
GetCommandLineA
GetModuleHandleA

shell32

ShellExecuteA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 171KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ