e1105fc070b82ea140629d6368d75306_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1105fc070b82ea140629d6368d75306_JaffaCakes118
Size

8KB
MD5

e1105fc070b82ea140629d6368d75306
SHA1

9c83ce178e358f9267528deaaa5d11e9ecce0792
SHA256

1834cf388a9db6981187c54c240b730176499669fd6eb3658420ac1e59198bcf
SHA512

01824ecb33fb112e08f899faec098deacd2632bb00671c9c815db7c8d6bddb61047160d199f4a22f41173fba5fa4061165fa2a5f009d389b1007aec3e0fc7e35
SSDEEP

192:RmR1a4fK+nPOo9Ad0Slu3H+IdD7Xk7nL1N8Z5urkrJ:IR1a4CZS20SlfUD7Xk7LRe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1105fc070b82ea140629d6368d75306_JaffaCakes118

Files

e1105fc070b82ea140629d6368d75306_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9311d05298e866c0e1627b9ea06db141

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
CreateToolhelp32Snapshot
GetModuleHandleA
TerminateProcess
lstrcmpiA
GetProcAddress
GetModuleFileNameA
Process32First
CloseHandle
Process32Next

advapi32

RegSetValueExA
RegOpenKeyExA
RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE