6520b7c14854fb473cf2a06670706b89_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6520b7c14854fb473cf2a06670706b89_JaffaCakes118
Size

3KB
MD5

6520b7c14854fb473cf2a06670706b89
SHA1

87c24fe71950fd5f0e14034a5e2719d761de4d8c
SHA256

8c1618d8c10f9d3aa43e8345ca70f3e3a78ba18b3ef0dc1eae71e4c4faf728e2
SHA512

1738c32b7fe30291e8df94833ceb5721ab95200d5734080c0fa33cb43408a7a98718fa2e3b3f6ddffeba402159e2511851203126ceab612a259e9cbdf8e35825

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6520b7c14854fb473cf2a06670706b89_JaffaCakes118

Files

6520b7c14854fb473cf2a06670706b89_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2ba8bfe642e84775dc40959bf3b18b66

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AllocConsole
CloseHandle
CreateRemoteThread
CreateToolhelp32Snapshot
GetFileAttributesA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
OpenProcess
Process32First
Process32Next
Sleep
VirtualAllocEx
VirtualFreeEx
WaitForSingleObject
WriteProcessMemory
lstrcmpiA
lstrcpyA
GetStdHandle
WriteFile

Sections

.text
Size: 1024B - Virtual size: 826B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 570B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE