d9f4777287867ad8002a3902060cf097_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d9f4777287867ad8002a3902060cf097_JaffaCakes118
Size

6KB
MD5

d9f4777287867ad8002a3902060cf097
SHA1

d3c0a139c56b2d11daf035bd1ff2897a9cbed995
SHA256

2c1f7220851a6f64c2615d9ea804ef09dea6e2bf1d2334ce939d91b9a8e5a252
SHA512

f2b63247b0717a7f85216e6181b06296e5c843b74118ea98d5e0148658be82df4e4693b7d7d4d97c93d0c07a65164dc5fec9692cca17abaf5dbe3889416de66d
SSDEEP

96:LTQU3m8XWOHSr+6iVq1jRsZ36hKcwm6XvP363Eg+gSU6h8X:LTQL0WOHSr+3MSZ36TwDXv/1Q1Y2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9f4777287867ad8002a3902060cf097_JaffaCakes118

Files

d9f4777287867ad8002a3902060cf097_JaffaCakes118
.exe windows:4 windows x86 arch:x86

87843c2bddf7feef3979e6a630a3f221

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateToolhelp32Snapshot
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
OpenProcess
Process32First
Process32Next
Sleep
TerminateProcess
WinExec
lstrcatA
lstrcmpiA

Sections

.text
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 378B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE