d458faa0a6ead3ac2bd052f94068a610_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d458faa0a6ead3ac2bd052f94068a610_JaffaCakes118
Size

14KB
MD5

d458faa0a6ead3ac2bd052f94068a610
SHA1

b7e856b3de8e5cfa81a308313c5b2e0d9332c2f6
SHA256

35017d3b6004db2b28c0d87f4a83fc358debcffd3d045bcfc9bcf45f85326931
SHA512

bebf5c5f738485bd0b4a194bc22ae1246c62615cfc416949e5142c6a38b87321fb53c5142c9ed0db68d4a0496a6653fa27d4c5497671dcff2a087cc16e7f995d
SSDEEP

192:3Jgk722N6c8+OnaRhW6Ap4ctak6A7lV2DCQyZmit1wtmIrh4RWvG:3DR6cZRhPATtT32JyZ9t1wtm4qRWu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d458faa0a6ead3ac2bd052f94068a610_JaffaCakes118

Files

d458faa0a6ead3ac2bd052f94068a610_JaffaCakes118
.exe windows:5 windows x86 arch:x86

78e35b3ab263739eb36f5c1331fe7a11

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
CloseHandle
CreateFileA
GetModuleFileNameA
ResumeThread
SetThreadContext
VirtualProtectEx
ReadProcessMemory
GetThreadContext
CreateProcessA
GetProcAddress
LoadLibraryA
HeapAlloc
GetProcessHeap

user32

wvsprintfA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.cc
Size: 512B - Virtual size: 477B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sett
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ