ce4aa3364e6a94680a277357b26432c5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce4aa3364e6a94680a277357b26432c5_JaffaCakes118
Size

23KB
MD5

ce4aa3364e6a94680a277357b26432c5
SHA1

66dc5f7bc2b8a0645d3a4a264b2723e5b16397af
SHA256

0252e5a1bc2421d662f83fc524646067a57b1335fecadc7ac301cfcb9bffd1f4
SHA512

5201c96aaaddaec42e2ed9e75b6db506b00474ad9d930d87066c228fb18e837c020161ab8f85d3555c4116f4c5edb28585637a1eff2cf4eff36c5080cba3d952
SSDEEP

384:ZgBYpBG+OVwO7cbIk7PcVGhS4aX0c+PJkE7hE+XKJyS5n53ql5t695iw6eU:AYXNVtWG+X18hECKJySvAt695t6h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce4aa3364e6a94680a277357b26432c5_JaffaCakes118

Files

ce4aa3364e6a94680a277357b26432c5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c1a73792b94d69bfd88f63df690597f5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
SetLastError
VirtualAllocEx
SetThreadContext
GetThreadContext
GetModuleHandleA
ResumeThread
ReadFile
OpenFile
GetModuleFileNameA
LockResource
SizeofResource
LoadResource
FindResourceA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetStartupInfoA
GetCommandLineA
TerminateProcess
GetCurrentProcess

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ