01e0f1593913e5ec5bb35518c6fe4ec5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01e0f1593913e5ec5bb35518c6fe4ec5_JaffaCakes118
Size

117KB
MD5

01e0f1593913e5ec5bb35518c6fe4ec5
SHA1

b586b08731c146c85b82e27e4de65dc14b6258da
SHA256

6133f3431e7b7394481f4f0bed46a527da652b0773406437eba031a58856a344
SHA512

cbc3e5b9a0dc59e22239795622cb2f96d40c8b666186919d08e7193c7ccea0c4c366991415b2f6608f5359bb0a8a6d36630340ed376c13d2383d04be83e3fe33
SSDEEP

3072:tsZRPyb7GSX5noZREI9f9WpFoINOpTAonSjSlgOqTyOuNuUW:ER4lXCEoWpqdlnqTyOWY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01e0f1593913e5ec5bb35518c6fe4ec5_JaffaCakes118

Files

01e0f1593913e5ec5bb35518c6fe4ec5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e396706c3eaa64f5032576c47165fdc6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext
LoadResource
LockResource
ResumeThread
RtlZeroMemory
SetThreadContext
SizeofResource
VirtualAllocEx
WriteProcessMemory
lstrlenA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ