8b0e209512ad21ba7c816b446030e10f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8b0e209512ad21ba7c816b446030e10f_JaffaCakes118
Size

6KB
MD5

8b0e209512ad21ba7c816b446030e10f
SHA1

78d1744f3e61aff2619977c015a00ceddddbd469
SHA256

dbcc7fe217ab6cbf4766f83f8cb52a6a9bc265c84a215f61760e06cdea7c3815
SHA512

2dc9a81786cb9295161ccb01e4c5b227253d925c42a739d440ebb4032d9dbb40281c25c595c4900c374c13eb3eb075e43a3b29db718b9b3cb36c636447dcca7d
SSDEEP

48:ZvtBQAeZTXZRLdpm3EDv0pEDGDiDv0p2DgSAShPoLLSduvfEAMoBAOn:Z1LyT3hpQEguqDigckPShQ6wHEcK6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b0e209512ad21ba7c816b446030e10f_JaffaCakes118

Files

8b0e209512ad21ba7c816b446030e10f_JaffaCakes118
.exe windows:1 windows x86 arch:x86

0ae8fb7966ca3f44ef5bf1eddeb1c738

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharToOemA

kernel32

CloseHandle
CreateFileA
CreateProcessA
CreateRemoteThread
DeleteFileA
ExitProcess
GetModuleFileNameA
GetProcAddress
GetStartupInfoA
GetSystemDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
ReadFile
Sleep
VirtualAllocEx
WinExec
WriteFile
lstrcatA
lstrcmpiA
lstrlenA

shell32

SHFileOperationA

Sections

.code
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE