e1d257d06ea5d7eea29e7c467ecf0a93_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1d257d06ea5d7eea29e7c467ecf0a93_JaffaCakes118
Size

9KB
MD5

e1d257d06ea5d7eea29e7c467ecf0a93
SHA1

7fd2f7877d44a634e51f77c0c30b89d5209f7476
SHA256

4969abf15c317e390f58c77d4e44ce65f13e23975c65d4b6d54d4dca65255931
SHA512

6b2d08eb38b1f3c2249d393f79c7923efca6adb7b47d7ffe52e74f29941b85687d95a494f07b170a9432fb5cf378fc06cf637acf3b410638bb987be510a52bd7
SSDEEP

192:HbsbP+KGxfhFj9/1p+6CvJfBU+YNmgp1I50I20TAefxU:HE+PZ//2vJfBB1gp1IqI/C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1d257d06ea5d7eea29e7c467ecf0a93_JaffaCakes118

Files

e1d257d06ea5d7eea29e7c467ecf0a93_JaffaCakes118
.exe windows:5 windows x86 arch:x86

035ae1cd5c5ee2002fe63a1813b491f0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrcatA
lstrcpyA
SetThreadContext
GetThreadContext
VirtualProtectEx
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
CreateProcessA
ExitProcess
CreateFileA
GetTickCount
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
Sleep
ReadFile
OpenMutexA
GetModuleFileNameA
ReleaseMutex
CloseHandle

user32

MessageBoxA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 594B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE