cf6561279ce2616ee984943a532a8610_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf6561279ce2616ee984943a532a8610_JaffaCakes118
Size

5KB
MD5

cf6561279ce2616ee984943a532a8610
SHA1

82004d3491f7cc15542df7b61e814fc55c8f7396
SHA256

5c613ad73d5a944d4b597e4ca421909edeb5da370551e3d9f1762492f6f0f377
SHA512

a767fb20691b8b06bc45fadb641fedd062c02075153b02323b2070653c2ef35d8a176c75b27de5137974ef70e091ae928a8be6944a8c012b8e4e3866261bec04
SSDEEP

96:9tzDg7VAePEYGFbuSpJv37ZPoA622JE4fmhM:bzDg7yecYiPjxwhfGM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf6561279ce2616ee984943a532a8610_JaffaCakes118

Files

cf6561279ce2616ee984943a532a8610_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a9f544e558731907efd89d1e721e5e41

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext
LoadResource
LockResource
OutputDebugStringA
ResumeThread
RtlZeroMemory
SetThreadContext
SizeofResource
VirtualAllocEx
WriteProcessMemory
lstrlenA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ