d245958a8d1545e14a3a2dc3f212a5e4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d245958a8d1545e14a3a2dc3f212a5e4_JaffaCakes118
Size

17KB
MD5

d245958a8d1545e14a3a2dc3f212a5e4
SHA1

3382298a593784bab09e88eec0e93ca568ab9933
SHA256

0a9229f957257da1d231dfc75ba59e4d929deffed5293fca53d5b571086bbfe8
SHA512

0906c0eb2f4fe2a96b655e30862f7e859f9311bb7b41f533cd80267b82cf94279414d8ef66759c6a94753545a719b7db1b31b891fbcc7283fec8044a5a37200e
SSDEEP

384:Lcu/n4Q25xWwU1QN6TXcX6t4QTfEmBAbwPCJxy/rwN:LcugQkWt1QN6TMKaQT/AGCJFN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d245958a8d1545e14a3a2dc3f212a5e4_JaffaCakes118

Files

d245958a8d1545e14a3a2dc3f212a5e4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ecf086c2b8ebca08848a7f503ab06521

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
ReadProcessMemory
GetThreadContext
VirtualAlloc
CreateProcessA
GetLocalTime
lstrcatA
ExpandEnvironmentStringsA
GetModuleFileNameA
ExitProcess
GetCommandLineA
HeapAlloc
GetStartupInfoA
GetProcessHeap

shlwapi

PathFileExistsA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 630B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ