712c28376d38c3c60ac9b6860d18f05e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

712c28376d38c3c60ac9b6860d18f05e_JaffaCakes118
Size

4KB
MD5

712c28376d38c3c60ac9b6860d18f05e
SHA1

0e6c335776c494c0d16cd0d1ff9adea508e6df76
SHA256

46a5eb469485b0ee3e9400a4d8933686896a65fc67fbc550728dc70654c50887
SHA512

1435540ee665e8fc988b568bbaa9eba62756978a17c77b6a6a10f7f1ed86683ea52b71ca87b9714021292e3e691c0258e42a8cd977cc301a556c78cb8342117d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
712c28376d38c3c60ac9b6860d18f05e_JaffaCakes118

Files

712c28376d38c3c60ac9b6860d18f05e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9e099e729afe8628e4f025a477ab8cc0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateRemoteThread
WriteProcessMemory
GetProcAddress
LoadLibraryA
VirtualAllocEx
GetThreadContext
CreateProcessW
lstrcatW
lstrcpyW
GetCurrentProcess
SetThreadContext
TerminateProcess
ResumeThread

user32

wsprintfW

advapi32

RegQueryValueExW
RegOpenKeyW

shell32

SHGetFolderPathW

Sections

.text
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE