760ebbf6bb32ea0ab7b8bedf1d423147_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

760ebbf6bb32ea0ab7b8bedf1d423147_JaffaCakes118
Size

7KB
MD5

760ebbf6bb32ea0ab7b8bedf1d423147
SHA1

3fadd7779a890d71877dc5ce1a6ce5ef1637d0d2
SHA256

93ba489bc3e149dfbaba69ca2e5feb6120aadc25cf9ad03f0b0ad1ce41848550
SHA512

5a55838e59d42fcb03f97d047a3cd0b3a54627ef4273a79f6615f50cc506168deb6362617071067080bb8566f9ce2f255b2aa62fc9a8e736b6f80a95d81f881d
SSDEEP

192:QXRdMGP9U34N6zJqEU3d2AaBU7PaYtxJ:QXRdb1UQIc8wPao

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
760ebbf6bb32ea0ab7b8bedf1d423147_JaffaCakes118

Files

760ebbf6bb32ea0ab7b8bedf1d423147_JaffaCakes118
.exe windows:1 windows x86 arch:x86

251575623650bc933bad8739ca1c1602

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
Sleep
CreateThread
ExitProcess
VirtualAlloc
RtlMoveMemory
WaitForSingleObject

user32

MessageBoxA

ntdll

NtSetInformationThread
RtlDecompressBuffer

Sections

.code
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 390B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE