d29fa75a8568bbe71900b72f3517e090_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d29fa75a8568bbe71900b72f3517e090_JaffaCakes118
Size

141KB
MD5

d29fa75a8568bbe71900b72f3517e090
SHA1

ecda001d9c0e6ba3bf4ed33d2edf2d5603c1ebce
SHA256

6f950b9fb15fda03706c044a46bc9808b92aba49eb99e1fbf7ab9789097e6c71
SHA512

7541fce7fda105d5dbeafcc0645bf5f0f23c475f83fc38a7ae23d1afa4cc6d8e90501d33f628d5a2e2df2ad3fea3a19eb4c7811c39cac45ba7cf3f04e6c5c5d7
SSDEEP

3072:5Cpw5RCpw5vB/Sf0srGGxnXxWO+5n2ThWsNexPnCrnS5n2ThWsNexPnCrnd:Sw5Kw5vBM0exXxTEnkP+6bwnkP+6bd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d29fa75a8568bbe71900b72f3517e090_JaffaCakes118

Files

d29fa75a8568bbe71900b72f3517e090_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d3a008f4f08a505723cdb1f0aaf0d3a8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteProcessMemory
VirtualAllocEx
GetProcAddress
LoadLibraryA
VirtualProtectEx
GetThreadContext
CreateProcessA
GetCommandLineA
SetThreadContext
ReadProcessMemory
ResumeThread

user32

GetDC

gdi32

SetTextColor
GetTextColor

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE