4907afd79e7e2894d370aee8e6b3fba9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4907afd79e7e2894d370aee8e6b3fba9_JaffaCakes118
Size

26KB
MD5

4907afd79e7e2894d370aee8e6b3fba9
SHA1

d9a5939e82966e0ab5a7fbdd445e26658ccb2c39
SHA256

b3a9d8c9e931c8bb2e4fcb21a3dd59c20ca76777edd158ac5d72cba4d54269f9
SHA512

29634fb3f7ca1f79f467a2cbba5800ba30adf51eb465d487c68a7ad7715980a8dfe96ed5b1026ea812a4dda16e6ba2a33debf42af4cb26e91359080a718e3436
SSDEEP

768:DQyQJ4ph1nV1qEGT2B8GjYUYXoPpV8OyfN:UHyv1V1qEGKK6pVYV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4907afd79e7e2894d370aee8e6b3fba9_JaffaCakes118

Files

4907afd79e7e2894d370aee8e6b3fba9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a1ec8dce401eba16d45a4f1aa06ebd77

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
VirtualProtect
ExitThread
CreateFileA
WriteFile
CloseHandle

msvcrt

memset
_CIacos
memcmp
_mbsnicmp
_mbsncmp

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE