fd611431d451aa8684af1d605e5e4571_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fd611431d451aa8684af1d605e5e4571_JaffaCakes118
Size

14KB
MD5

fd611431d451aa8684af1d605e5e4571
SHA1

0b85b680b9c3b5ca8d637f1639cc11032a8425b9
SHA256

3a73f7282f70748751a9895008e4195720500ecdee1d63451ff56ad9e4d1a07a
SHA512

d4649b7def5ff14d2e9bc72809c9826e75e4cdd3af57c9a4863170f57662f2e5101f39ae7b999d6ec29f701223ef7feb3a3094f638747ac8f890863d0b7a266c
SSDEEP

384:vW9KArmu+7jU24q28MfUnQTrMtDc9w6ay:u4OmukjUbq2PfUQTrMJcnl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd611431d451aa8684af1d605e5e4571_JaffaCakes118

Files

fd611431d451aa8684af1d605e5e4571_JaffaCakes118
.exe windows:4 windows x86 arch:x86

058dc95f89656af78e1cde9d00861259

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateProcessA
ExitProcess
GetEnvironmentVariableA
GetModuleFileNameA
GetShortPathNameA
GetThreadContext
ReadProcessMemory
ResumeThread
SetThreadContext
VirtualAllocEx
WriteProcessMemory
lstrcatA
lstrcpyA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE