c1b2f2632d694bcd1a326ac19b643174_JaffaCakes118 | Triage

Sharing

General

Target

c1b2f2632d694bcd1a326ac19b643174_JaffaCakes118
Size

57KB
MD5

c1b2f2632d694bcd1a326ac19b643174
SHA1

123de5f01d9ff8b2f5f84d207c027038c80ebfb7
SHA256

9ec4dea2ebbd4a5eadfbd3d888ad56c3815b1ad3eda9e088870660f3ad6046c6
SHA512

98974eb77213952c353eb960598466ec834b074e890f92791a3beb25203c4a7d2da84a425ef0016568b21fc4ffa5719a13190f836bbc3244f7f1d3ff6b6190ad
SSDEEP

1536:MzCPpul3F7RzRZMp63/DIUfzKHSICzA/8XB5:vuBx3P3b2IM+5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1b2f2632d694bcd1a326ac19b643174_JaffaCakes118

Files

c1b2f2632d694bcd1a326ac19b643174_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fce7809a30096dee5d325be7178490ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetThreadContext
GetTickCount
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SizeofResource
Sleep
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteProcessMemory

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ