8d4908ee8c64b8da19572f53f0316f9b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d4908ee8c64b8da19572f53f0316f9b_JaffaCakes118
Size

77KB
MD5

8d4908ee8c64b8da19572f53f0316f9b
SHA1

831b90b4f576f2342e68cd47ffa6da96be8329ae
SHA256

6bbc740762dbe955723ccb203e35f603eab0f71314dac568610d1c1c0630dba8
SHA512

c417781591d2df9a95cd67e6567c5083bc249daa25dc5281dcc0d3f242bd58fd89bb138187d74c16c7a49ef5da2b948adb033b3a5331bd3bd99e2c687443cfe3
SSDEEP

768:Lwig5FPDUI7mOk0fTwUUigCdYrnIY7IV04jXPFhRF1fmlU2jNckOwNG/IyXHCwLY:2zF7dUFQ4IYcPFhP2j6JwU/VXiqgWV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d4908ee8c64b8da19572f53f0316f9b_JaffaCakes118

Files

8d4908ee8c64b8da19572f53f0316f9b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d89559a5240ff25d9024bed8f7d4b543

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
ExitProcess
CreateProcessA
lstrcpyA
lstrlenA
SetFileTime
GetFileTime
CreateFileA
GetWindowsDirectoryA
SetFileAttributesA
CopyFileA
DeleteFileA
CreateDirectoryA
lstrcatA
lstrcpynA
lstrcmpiA
Sleep
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetLastError
CreateMutexA
WriteProcessMemory
ExpandEnvironmentStringsA
GetCurrentProcess
GetProcAddress
OpenProcess
GetCurrentProcessId
lstrcmpA
ReadFile
GetFileSize
SetLastError
VirtualFree
ResumeThread
GetPriorityClass
VirtualAlloc
CreateRemoteThread

shell32

ShellExecuteA

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ