4cd5e2c9e5774d471673b8f520aa67a8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4cd5e2c9e5774d471673b8f520aa67a8_JaffaCakes118
Size

351KB
MD5

4cd5e2c9e5774d471673b8f520aa67a8
SHA1

ea3811b952653527ff32f0d9058fa5d8f342d16c
SHA256

85f0aecb212b96403d68f11d1ba4fc0a532cac6096bca552a1e61dddbb5e50db
SHA512

95aff9ece5775be50bf41caa3a8e9394d5c5d43e7e5e391574c29ea3d208417a22a7ac5d70f84e53cd25b6b39bb22748a4b1f60255c95b42a3fb545428e4fa1b
SSDEEP

6144:yLu9lJLViuEZsrMpe5nKtIw+T462HAnwkd+wJyOyEqrGndWBpDGkibu0y0zznMiT:FJNMcBvN2gnD+2q6nypDdGuUMiCY9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cd5e2c9e5774d471673b8f520aa67a8_JaffaCakes118

Files

4cd5e2c9e5774d471673b8f520aa67a8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

559398b1246f3c18c513f21a971018a0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetVersionExA
GetModuleFileNameA
WaitForSingleObject
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
GetThreadContext
CreateProcessA

user32

CharLowerA

msvcrt

malloc
strstr
free
fclose
_filbuf
ftell
fseek
fopen

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ