bfaf8910d17937a3895874227b5ca777_JaffaCakes118 | Triage

Sharing

General

Target

bfaf8910d17937a3895874227b5ca777_JaffaCakes118
Size

4KB
MD5

bfaf8910d17937a3895874227b5ca777
SHA1

eb74210ebb5742b0a03a5ba5a3480ca1f5e9a217
SHA256

96e65b0c997a57a392228d07b3c4afc5c933ba6dca83cbf4c431fe81cb213248
SHA512

ae2df6776cc1881708abcb3fc4e4b7c0f49e6f94b48ca69132b408e118213c329496d5735e03bb4542cc55da9932cbc6004acc6526334471127c64e704b61722
SSDEEP

48:6G0YzO0/gaEXXzdJuUv5+JmCQr83/wDRCOhuEvorcg:rz69ruUv5+w7RRCC5K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfaf8910d17937a3895874227b5ca777_JaffaCakes118

Files

bfaf8910d17937a3895874227b5ca777_JaffaCakes118
.exe windows:4 windows x86 arch:x86

06859f40edfc901cd32221d14726c3a6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
CloseHandle
ReadFile
SetFilePointer
GetFileSize
CreateFileA
GetModuleFileNameA
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
TerminateProcess
ResumeThread
SetThreadContext
WriteProcessMemory
GetProcAddress
GetModuleHandleA
VirtualProtectEx
VirtualAllocEx
HeapAlloc
GetProcessHeap

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 45B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE