5b0081f536e42923a7af87a529edf32f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5b0081f536e42923a7af87a529edf32f_JaffaCakes118
Size

34KB
MD5

5b0081f536e42923a7af87a529edf32f
SHA1

95bea061b75cd321d46415b0a3cf7892452eec04
SHA256

279d26bb964d63665a5a555d2c07a02b2d484c4ff9218194fbc5011773906bff
SHA512

0d944eb072d60d3e97e06ea07a13a0bf023ed45056f91b9533748408b3117b7fefbf443b7c3ab5ea94fc008d1d8a32ed4ba216a4230a580ff78ea41b183b1f63
SSDEEP

768:s+vxVezeIPFJFXc/pvH8ObHjMNm9ZV2eBm+mGeWi2W:5eBPvFX4H4NQI+mGAJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b0081f536e42923a7af87a529edf32f_JaffaCakes118

Files

5b0081f536e42923a7af87a529edf32f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fce7809a30096dee5d325be7178490ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetThreadContext
GetTickCount
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SizeofResource
Sleep
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteProcessMemory

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ