c011a9e630ecdd0fa04c429a475eb77d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c011a9e630ecdd0fa04c429a475eb77d_JaffaCakes118
Size

10KB
MD5

c011a9e630ecdd0fa04c429a475eb77d
SHA1

25e29464525f3414661352f9e3d1540577873460
SHA256

5b1128f4fb8c2458db9251506900756f115a3df553c1bac3dd6bb3417800591d
SHA512

c49268f2b1a3d2a0813436ddec46e6236d652730f15c927ac06d6f732b249237eccc931939c09e67bb1245908f3b1bd6df8cb38dcce92a1d820edb4158965e94
SSDEEP

96:o8RugukulR74Vc86vhvo4kV5EK5KX5ae2mmZ2VjIaNd34u8Lv8exVBhqW40b:ernlRiAo4yImZAjtonnhqmb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c011a9e630ecdd0fa04c429a475eb77d_JaffaCakes118

Files

c011a9e630ecdd0fa04c429a475eb77d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

14477decd904a0384439ba6bf659dc20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crtdll

memset
strlen
strcpy
strcat
strncpy

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
InitializeCriticalSection
GetCurrentProcess
DuplicateHandle
CloseHandle
CreatePipe
GetStdHandle
HeapAlloc
CreateProcessA
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
HeapFree
FindClose
FindFirstFileA
FindNextFileA
HeapReAlloc

shell32

ShellExecuteExA

Sections

.code
Size: 512B - Virtual size: 353B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.flat
Size: 512B - Virtual size: 45B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE