680babe7d4e4d204dd329a5594a964b6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

680babe7d4e4d204dd329a5594a964b6_JaffaCakes118
Size

4KB
MD5

680babe7d4e4d204dd329a5594a964b6
SHA1

5f0bd64e2f5b0d5837756b713ef42474e35caaf8
SHA256

6b82ed39d137454277e580628b811d6abfdf32419aef29280ab03df557195a1d
SHA512

c8d7eccb5b0442f99c4b8806a90dbd364073214c050d32520dfb1a05d1ce476590e11982ab513f33efc431e4114223c712920822e74e4efb5976d410b7936370

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
680babe7d4e4d204dd329a5594a964b6_JaffaCakes118

Files

680babe7d4e4d204dd329a5594a964b6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d666e9a4b43284fb4d391d5e7b86b7f5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
CreateProcessA
DeleteFileA
ExitProcess
FreeConsole
GetCommandLineA
GetModuleFileNameA
GetProcAddress
GetThreadContext
GetWindowsDirectoryA
LoadLibraryA
ResumeThread
Sleep
VirtualAllocEx
WriteFile
WriteProcessMemory
lstrcatA
lstrcpyA

shell32

ShellExecuteA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE