8a6bf984f8dac3230434834752bc9b20_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a6bf984f8dac3230434834752bc9b20_JaffaCakes118
Size

9KB
MD5

8a6bf984f8dac3230434834752bc9b20
SHA1

5dd0435b9358c435af6dda0a578d2bc69c32e17e
SHA256

2651f23b3249f8f40ac3072d042531b074393f582c0012064c7b1b50ae6a7a15
SHA512

61f3ca3985d3c8da6a3a263d175795875f5b31c46804189e13fe7cae2cc6a14c812ee7a3ecbf5f2443577e01c5cd2013f5a080307b7c872cca968e8c94e12afc
SSDEEP

192:fzzolR09nosktdIzg+66dpCX4G0SMMwokIFf:PF9k+VXCX0Shks

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a6bf984f8dac3230434834752bc9b20_JaffaCakes118

Files

8a6bf984f8dac3230434834752bc9b20_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ce7532d8ab10f1f3db59a877b2263051

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
ExitProcess
FindAtomA
GetAtomNameA
GetFileSize
GetModuleHandleA
GetProcAddress
OpenProcess
ResumeThread
SetThreadContext
SetUnhandledExceptionFilter
VirtualFree
VirtualProtect
VirtualQuery

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
exit
fgetc
fopen
free
fseek
malloc
memcpy
signal

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 432B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE