6efe23d0fd07c559e447453db5cf0d04_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6efe23d0fd07c559e447453db5cf0d04_JaffaCakes118
Size

45KB
MD5

6efe23d0fd07c559e447453db5cf0d04
SHA1

573f1060d52b3239ca101e153811768948f4848d
SHA256

8bee5c5546b5ebd9b0e8383b593d67807c19f189e9a2b26b8aa232624366a983
SHA512

876f16d53686b5d564ab57f27dbb67dd80d5d3c9f8000ab78c3f640bf3a284c4e072b1932e49fe5cf10dda824fa975e917fe1048313eccc0c1382ba071769b11
SSDEEP

768:JQ/V1S8YzXBTD3JVVgz7aSPReR/Zu95/mE2CGW6hZQkAxdHGHd8cBUOpDB4W533U:JQNcFrRDZEz7pp2Ru95/Y1LQkqmZvpOr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6efe23d0fd07c559e447453db5cf0d04_JaffaCakes118

Files

6efe23d0fd07c559e447453db5cf0d04_JaffaCakes118
.exe windows:1 windows x86 arch:x86

92009019dee90696f2364d47b68ae436

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessInternalW
CreateFileW
ExitProcess
GetFileSize
GetModuleFileNameW
GetThreadContext
GlobalAlloc
ReadFile
ResumeThread
VirtualAllocEx

ntdll

NtSetContextThread
NtWriteVirtualMemory
ZwUnmapViewOfSection

Sections

.text
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 42B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE