8d185f6695a89c9e57389f71095027d2_JaffaCakes118 | Triage

Sharing

General

Target

8d185f6695a89c9e57389f71095027d2_JaffaCakes118
Size

90KB
MD5

8d185f6695a89c9e57389f71095027d2
SHA1

dadca619bb3416fd8c0d378673bd858c0e51e8eb
SHA256

fb5cf5bc0304cf4e2abdf6bb90039eb0209c979a8a2a9a1089f1f287c24be8ed
SHA512

d00a23a4afdd8781bd29e88efeaa5b794f083143ffd5ae7be6ec123635537dd5ff43de590fe590fa69a0a5dfeee8a4a7b3974e091d690dbbefb154083dfa273b
SSDEEP

1536:H8aiUvdVBAbrkfFX9tpORy/H883ToyXjzJbRo7Fiax0BZYNzKJUouTOqn5wgcAeV:cEarK1ERCH883TPjdiBxFJKJ6Cq5xze

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d185f6695a89c9e57389f71095027d2_JaffaCakes118

Files

8d185f6695a89c9e57389f71095027d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

87732bc5541f4485640a20b4b1d23e26

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
CreateProcessA
ExitProcess
FindResourceA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetThreadContext
GlobalAlloc
LoadResource
LockResource
ReadFile
ResumeThread
RtlZeroMemory
SetThreadContext
SizeofResource
Sleep
VirtualAllocEx
WriteFile
WriteProcessMemory
lstrlenA

user32

MessageBoxA
GetKeyState
GetCursorPos

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE