7474944585816e024e4c33700500f0ae_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7474944585816e024e4c33700500f0ae_JaffaCakes118
Size

28KB
MD5

7474944585816e024e4c33700500f0ae
SHA1

5c88d2d5027c14a7885e5f2a4f2a32b2aa4cf7c1
SHA256

5f7b88037c087939808aeb9cd10718e65c5e0c382f1cc8e8c5005d5665ef99f9
SHA512

f8b17d354033f24d5250db18061a7fed8c4a8673009bad83f5b6566c81de5aceb72647d7e97d5b7acb518ab98a47f063575021d755cf9705804d6bbf64f770bd
SSDEEP

384:7TDtsP9OjQaQMcV7+vHGAi28FBBCU0QfTfcnSr9B9DN6vBDubeYnzqk:rs2QTVIGAi22PMSNDN6vgbeYW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7474944585816e024e4c33700500f0ae_JaffaCakes118

Files

7474944585816e024e4c33700500f0ae_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f777bf983ca2a5bb5eef0ac3f8f950c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetProcessVersion
MoveFileA
GetTempFileNameA
CloseHandle
GetModuleHandleA
lstrcmpiA
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

ZwQueryDefaultLocale
NtQueryAttributesFile
mbstowcs
_atoi64
NtOpenSection

Exports

Exports

WriteRhmkmkwtj

Sections

.text
Size: 4KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ