db783ac0663732c2de62e4eb873a6817_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

db783ac0663732c2de62e4eb873a6817_JaffaCakes118
Size

83KB
MD5

db783ac0663732c2de62e4eb873a6817
SHA1

caa89c0640f24541d4135041087b51345c9a206e
SHA256

a68da25b08a950f7bd8bb8334c96504bdb763a7d99885cf50fb855fcd8c7f6f9
SHA512

26da85306bfc8f3ced4cf06d52b630aa29396ba3665fc65ab4d136860ca71838f9507d8e96af7a775d2979f0c58a98564de72517e285b4bfbe85509c3dd74486
SSDEEP

1536:WAEvRouIQb5ojdV3zJJWjjxm3Eso0lxBtT4pKo4xuHIjRGDJ48lMcq037Srf3hm2:WAE/5q39JWsoanVutojRYJ4+3qrzYiJ7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db783ac0663732c2de62e4eb873a6817_JaffaCakes118

Files

db783ac0663732c2de62e4eb873a6817_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fce7809a30096dee5d325be7178490ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetThreadContext
GetTickCount
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SizeofResource
Sleep
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteProcessMemory

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ