844faeb60800feebad3bcc0d89a4f443_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

844faeb60800feebad3bcc0d89a4f443_JaffaCakes118
Size

84KB
MD5

844faeb60800feebad3bcc0d89a4f443
SHA1

dfca36e87dc3af4350e6e3af68f2c362bca803f3
SHA256

b56237daf288bb3c4b639fb96f0674a535a881cbdbaba05306363acc437a301d
SHA512

3566e6bf13271371ce9bbc7d427b12a9ed72d7036793009436e4aa7001291dd318c0072d34c5fb0281671cfb373e03e194af95bec310990d099a23d56d6ed85d
SSDEEP

1536:0GhC9YvHSL7c05lfkX0Ohnq+cl+Ek74vxblow1kIYFIGrjf84yuW:0GhdSLY0L4tnAIEkcvN1kIYFX81uW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
844faeb60800feebad3bcc0d89a4f443_JaffaCakes118

Files

844faeb60800feebad3bcc0d89a4f443_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a9f544e558731907efd89d1e721e5e41

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext
LoadResource
LockResource
OutputDebugStringA
ResumeThread
RtlZeroMemory
SetThreadContext
SizeofResource
VirtualAllocEx
WriteProcessMemory
lstrlenA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ