5ab6ea1db64eee6fd24c6b81fb7c1b39_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ab6ea1db64eee6fd24c6b81fb7c1b39_JaffaCakes118
Size

73KB
MD5

5ab6ea1db64eee6fd24c6b81fb7c1b39
SHA1

d0d59f540484bfffaacd271ffc8ad04719b7a870
SHA256

9d4134995d634b95cc771dcc9248d8cb3f5bf5eac0790b20e8722e769bc15553
SHA512

2c11eeb7874f5ffb0e794c2e1b206091a81aa32610cd2450f5614442a487693b19c9a06607ad4b537fd2b246622628b2f1ca51079a969e0f5c928506b9bce82d
SSDEEP

1536:D/InEX3phjMi5NE4Oj440Qrq52+VNSeCh+pB8RkZagbR3:D/xEi5u84drCN2h+kRIh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ab6ea1db64eee6fd24c6b81fb7c1b39_JaffaCakes118

Files

5ab6ea1db64eee6fd24c6b81fb7c1b39_JaffaCakes118
.exe windows:4 windows x86 arch:x86

35347c755519b7d0311887e16c6cc7d2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHAddToRecentDocs
StrRChrIA
StrStrIA

kernel32

CreatePipe
TerminateProcess
VirtualProtect

Sections

.text
Size: 39KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ