d67267708c4f50d2bf26c4620df4e9cb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d67267708c4f50d2bf26c4620df4e9cb_JaffaCakes118
Size

19KB
MD5

d67267708c4f50d2bf26c4620df4e9cb
SHA1

2814417e7d8e16f1203e5f76c2963905ee6cd3cc
SHA256

344c595c08dd68bd489961b2f36a00cf94415e3849eec0935cde9cafdd3ffd67
SHA512

88af3fb0c197c9dc81d9bc7e2f6c3cd940129a5098315f7b5e89ce3ff99bd38003010902078349ad44e00f2d6014e6d8a808d853f2750bcfb8d942e3eee74df7
SSDEEP

384:foC2GtiQXaABsoosgGQkTfpslz7F+Qpm/yGE9W:V2SaAB7gGQkTGl1+Qpm/y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d67267708c4f50d2bf26c4620df4e9cb_JaffaCakes118

Files

d67267708c4f50d2bf26c4620df4e9cb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6d6e8dc75cbe61956b89a5f946ae0eae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
lstrlenA
CloseHandle
lstrcpyA
TerminateProcess
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
GetThreadContext
CreateProcessA
lstrcmpiA
CreateRemoteThread
WaitForSingleObject
GetProcAddress
GetModuleHandleA
GetExitCodeThread
VirtualProtect
VirtualAlloc
VirtualFree
GetExitCodeProcess
OpenProcess
LockResource
LoadResource
FindResourceA

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ