b2f7917f1a5f175910713f6cbaf8796b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b2f7917f1a5f175910713f6cbaf8796b_JaffaCakes118
Size

38KB
MD5

b2f7917f1a5f175910713f6cbaf8796b
SHA1

29e02a230d0f63d05a774d2e46b1cd83b57d4bdb
SHA256

611d3fef32009782f2fc88165a4f82d96564d5f95cb493c84db6eb019583ed1c
SHA512

a459335505800896179ce056bd73c3656279bd11fc46bd76def98ef19d464fb830af80761bfb1e2ee4f407ed54c4f480791d4ce797eb0cab6f623fbba5b5df59
SSDEEP

768:Uvt+xtyBQFBf3SSSSSSSSp7C7zDTB6ivd2TcqG5YHmStLWHbC:s+xtyOLSSSSSSSSdC7zDNd2T3GaHNta+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2f7917f1a5f175910713f6cbaf8796b_JaffaCakes118

Files

b2f7917f1a5f175910713f6cbaf8796b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

78c1b06aa2fcc56d503a713a49b2d01d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateRemoteThread
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetSystemDirectoryA
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
CreateProcessA
GetModuleFileNameA

user32

FindWindowA
GetWindowThreadProcessId

msvcrt

strcat
??2@YAPAXI@Z
strcpy
strlen
??3@YAXPAX@Z

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ