8e6e8a2da5b1f6876b42fb4d8d6c27b1_JaffaCakes118 | Triage

Sharing

General

Target

8e6e8a2da5b1f6876b42fb4d8d6c27b1_JaffaCakes118
Size

37KB
MD5

8e6e8a2da5b1f6876b42fb4d8d6c27b1
SHA1

5dbe577da1d4a476bd1c8acb8b67bf5791e485ac
SHA256

bd2f9f630671bc0f2135c580120b9e82952109aeecb45165c0dcd85f0b4d52d7
SHA512

a4c79abafda6958c3cc5158e1a002938dd49816dd062d874164ac95d66f6ef6d40b38e51066f6bc4cc726663be3040fea527b43d95b0f40efb74f390238b0df0
SSDEEP

768:bV22gCXHpXtaC3AqnqhaxNBPj4PY1PcqjaT5jKLPUwRNYt:b7p9arQBxDPUY03jJwDa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e6e8a2da5b1f6876b42fb4d8d6c27b1_JaffaCakes118

Files

8e6e8a2da5b1f6876b42fb4d8d6c27b1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a9f544e558731907efd89d1e721e5e41

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext
LoadResource
LockResource
OutputDebugStringA
ResumeThread
RtlZeroMemory
SetThreadContext
SizeofResource
VirtualAllocEx
WriteProcessMemory
lstrlenA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ