85737a51770ccd756ba367daf1ee7e21_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

85737a51770ccd756ba367daf1ee7e21_JaffaCakes118
Size

87KB
MD5

85737a51770ccd756ba367daf1ee7e21
SHA1

2e0fe58c8d25910a66fa0e18a7252ae87187b4d7
SHA256

b919754a01351a41da336f639bd3b31ea5204644b6a4d7dffe1c44762e5b307d
SHA512

cfb73e4051eed5cb318cc0cb21ef688c8d96bf6c42508c7fa56ac935547cef54536ba61d34dca1cb10d4efc4fad87240051a1e2aedc728f0e255d84a09c5d294
SSDEEP

1536:F7y8whrM4KnsIjdUbUr4F8oWmFuG4yahRAkTwKnrwRY:FuLKnsIjdUbUr4F8fmFuG4yahgMOY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85737a51770ccd756ba367daf1ee7e21_JaffaCakes118

Files

85737a51770ccd756ba367daf1ee7e21_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fce7809a30096dee5d325be7178490ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetThreadContext
GetTickCount
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SizeofResource
Sleep
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteProcessMemory

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ