59f16508b0313f2b9d551f5d826217fe_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

59f16508b0313f2b9d551f5d826217fe_JaffaCakes118
Size

143KB
MD5

59f16508b0313f2b9d551f5d826217fe
SHA1

5efd7a3b0f08842ddb50d47ebfc8e2c7159f42ff
SHA256

a1f26844506c8e55954b23918114f6bd5c097c86c9280bad3be8c20d5e53993f
SHA512

90136aa8d58ffc95e50b975043060239bd01ba1ff62d5d0b5db9738be84055f1ca7ff2d0f414a4ab0b1834d330f870ce9b3b997a16d9fdba980b3fdf28d2e15f
SSDEEP

3072:75SLpkwr313DEOEJJBD1BkksShY+FLt4RT:xwB3DeJVaSCQAT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59f16508b0313f2b9d551f5d826217fe_JaffaCakes118

Files

59f16508b0313f2b9d551f5d826217fe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

590a620663fed65d0dfcbd5ced8c8a5d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA

kernel32

CloseHandle
CreateFileA
CreateProcessA
EnumResourceNamesA
ExitProcess
FindResourceA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetThreadContext
GlobalAlloc
GlobalFree
LoadLibraryA
LoadResource
LockResource
ReadFile
ResumeThread
RtlZeroMemory
SetThreadContext
SizeofResource
Sleep
VirtualAllocEx
WriteFile
WriteProcessMemory
lstrcatA
lstrcpyA
lstrlenA

user32

LoadIconA
CharLowerBuffA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 493KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ