a4eb8c9956f9f7154af4af0bd5834c75_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a4eb8c9956f9f7154af4af0bd5834c75_JaffaCakes118
Size

22KB
MD5

a4eb8c9956f9f7154af4af0bd5834c75
SHA1

48b06c86fbcc4d2ad3ee691355ed1b89945cf950
SHA256

0d7a8f6fb4b90c6c787dd1932dbfe1cac732838944595550370b439eb5a7fa8e
SHA512

8aed5117a9226c88dd6299940fa856931268c65bf538408a8ca83afe1d5c7cb3a60fc63d288bbdeefda3e92fba6a7a45bb636eaab576b3804c8d8ac016884b05
SSDEEP

384:NXG/HBRcknCaqhXBm4WlLdGQCUc7ZlpHVkm5Dq6WemEeXq9qGZ9UXv/kWJnMIe:N25Rc/aEXBPWlLxc7lVl5eVEjZ9gvPde

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4eb8c9956f9f7154af4af0bd5834c75_JaffaCakes118

Files

a4eb8c9956f9f7154af4af0bd5834c75_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1901fa132c99a01befe01f9af3f73cf0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCommandLineW
GetThreadContext
GetTempFileNameW
SetThreadContext
FreeResource
FindResourceW
LoadResource
CreateProcessW
WaitForSingleObject
GetModuleHandleW
GetTickCount
VirtualQueryEx
WriteFile
OpenProcess
SizeofResource
ReadProcessMemory
GetFileAttributesW
CreateProcessA
TerminateProcess
GetModuleFileNameW
CreateFileW
lstrlenW
GetTempPathW
GetProcAddress
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
LockResource
Module32FirstW
lstrcatW
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
WriteProcessMemory
ResumeThread
lstrcpyW

shell32

SHFileOperationW
SHChangeNotify

shlwapi

StrChrW
StrRChrW
StrCmpNIW

msvcrt

free
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
malloc
memmove

Sections

pe
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ