f201a2c044026e948f92ff625bc83e1f_JaffaCakes118 | Triage

Sharing

General

Target

f201a2c044026e948f92ff625bc83e1f_JaffaCakes118
Size

151KB
MD5

f201a2c044026e948f92ff625bc83e1f
SHA1

cf4923de7a15f1d91090e2049d0caa343b8b7b63
SHA256

1e72ee5c21a74034982a7786815d8219738eb41a2f6d2fb662992aea0e1931e0
SHA512

1802865f2811a728b1db08c3dec7281a36e824062d6f03a1d9465abe4959d5534b628118e7e9087d0793a293295962825904ce987b112bdd488869a483613694
SSDEEP

3072:HhLKpkFJqH8LCSCuXr+jvxEFvon+k10vpKOvxGhkEi5cxKh3tJtKNG5l4Ff5YA:HhLocWSCuXr+jGF4BhkEOt2NvdiA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f201a2c044026e948f92ff625bc83e1f_JaffaCakes118

Files

f201a2c044026e948f92ff625bc83e1f_JaffaCakes118
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

fce7809a30096dee5d325be7178490ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetThreadContext
GetTickCount
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SizeofResource
Sleep
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteProcessMemory

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ