4ab03732d414c43b461d49c438562c46_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4ab03732d414c43b461d49c438562c46_JaffaCakes118
Size

4KB
MD5

4ab03732d414c43b461d49c438562c46
SHA1

1653a71629c3b7c2863d823aa99382bd34ccbb48
SHA256

186497296327352180106bd4616609feeda271643a915066c72bc41b6c21e314
SHA512

47f45a8e6f3b4546120f2ae8da2897cbb0aa16961b6e77cbb89611132d88f24c7b8824a8b30f0964cbaca7924e058174a3e66e64fe2a1fb1b8f2c352b99e62f7
SSDEEP

48:SoPEcAPFFWXng8W/vqTSdsHqQBcM+46Tsy1Z7se:3ArWXuJutnVWs+7s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ab03732d414c43b461d49c438562c46_JaffaCakes118

Files

4ab03732d414c43b461d49c438562c46_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d06a90957791b29845bd93d6b546dd1c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetMapMode

kernel32

MultiByteToWideChar
lstrcatA
CreateProcessA
ExitProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetTempPathA
GetVersionExA
HeapAlloc
HeapFree
LoadLibraryA
WriteProcessMemory
Sleep
VirtualAllocEx
VirtualProtect
VirtualProtectEx
WinExec

ole32

CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoCreateInstance

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ