e07d6611347063beb3c5a018f7381bc8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e07d6611347063beb3c5a018f7381bc8_JaffaCakes118
Size

122KB
MD5

e07d6611347063beb3c5a018f7381bc8
SHA1

96127932957c9cd5adecbe09b1456dbc689825e3
SHA256

e2e7d3637855cb5d5022c73a72e8d31e3d4ba7c59ff58df7d79b86674bb090d5
SHA512

0f1b41b5f89960a040672a48fbccde669bc4e91ad78fd027db4a3a2ac405e16ae8bb5c3776ad7df3bcdc216861865b7bac483b59bc6ff28a2c73b5c65bc12f2f
SSDEEP

3072:r4UNB2BR9o9PfqOzJd4YPf1IpCdJjGiE8LxSmO:CR6ZqyPLFosta84mO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e07d6611347063beb3c5a018f7381bc8_JaffaCakes118

Files

e07d6611347063beb3c5a018f7381bc8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dd7759ebaa002c72e2b38175afa4e123

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
VirtualProtectEx
LoadLibraryA
ExitProcess
GetLastError
OpenThread
GetThreadContext

user32

PostThreadMessageA
IsChild

Exports

Exports

Urfkmsp

Sections

.text
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.DATA2
Size: 3KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nsec2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ