70661385df3906d3e6a2656842fb08d3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

70661385df3906d3e6a2656842fb08d3_JaffaCakes118
Size

41KB
MD5

70661385df3906d3e6a2656842fb08d3
SHA1

62ce33dd0d905cc03d99c456cb297b2060410282
SHA256

1658b25dc44e7fdf47f5df9d93b787ed092021f246eeb70a39a711fe948f48ec
SHA512

c10180bb23ceec765645d659a9647092c804e9dabe9c8712b5b96ce38bdd182fc5353f3486d9aa72c78d6bb5d10b7fd551522c71907363f28c1dc38d741b10ac
SSDEEP

768:ccOOlWLVzAmTMFldeLYjlHpklseF1k7V9D5lsQsOI/2GgCOsp8+:ZOO+pAmTMFlpjlHpklMJSHeVCOO8+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70661385df3906d3e6a2656842fb08d3_JaffaCakes118

Files

70661385df3906d3e6a2656842fb08d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e2f55ad723bc08bb63b960b247a9d871

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA

kernel32

CloseHandle
CreateFileA
CreateProcessA
EnumResourceNamesA
ExitProcess
FindResourceA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetThreadContext
GlobalAlloc
GlobalFree
LoadLibraryA
LoadResource
LockResource
ReadFile
ResumeThread
RtlZeroMemory
SetThreadContext
SizeofResource
Sleep
VirtualAllocEx
WriteFile
WriteProcessMemory
lstrcatA
lstrcpyA
lstrlenA

user32

GetCursor
CharLowerBuffA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 493KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ