e011cc01d65a1e3cec270b117dfd51a3_JaffaCakes118 | Triage

Sharing

General

Target

e011cc01d65a1e3cec270b117dfd51a3_JaffaCakes118
Size

68KB
MD5

e011cc01d65a1e3cec270b117dfd51a3
SHA1

96e9335b63b912925ae82877c0360852ef1425e5
SHA256

53bcf83b6f91c911b345cebdebe676471028d197bde3e42ba37ba776f287e29d
SHA512

10a749747f04d842cbd93f6cec38aeac0fbc676d31667bb0ff5811435328a20d0259360f82f359485b5a81427a9943d576a16a8ff1c2a8981a0a947c7fe18e17
SSDEEP

1536:KQw83AZMKErqwc99fHiEMU5OIAWa7r1x+J4nonGz/NF37U4z:KQfe91iNvIDa7jHoGjNFw4z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e011cc01d65a1e3cec270b117dfd51a3_JaffaCakes118

Files

e011cc01d65a1e3cec270b117dfd51a3_JaffaCakes118
.exe windows:1 windows x86 arch:x86

92009019dee90696f2364d47b68ae436

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessInternalW
CreateFileW
ExitProcess
GetFileSize
GetModuleFileNameW
GetThreadContext
GlobalAlloc
ReadFile
ResumeThread
VirtualAllocEx

ntdll

NtSetContextThread
NtWriteVirtualMemory
ZwUnmapViewOfSection

Sections

.text
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 42B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE