01c1476a15d8173367a262a300e22886_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01c1476a15d8173367a262a300e22886_JaffaCakes118
Size

61KB
MD5

01c1476a15d8173367a262a300e22886
SHA1

46397f446836eee0fb3c182013261cca0173808e
SHA256

ead6d30d80c333538fbc2e8f6e4f5f799c1bc2ac0f190104d2bfbfb9c2d74bde
SHA512

fed649338c24c4fd7c3927ebaf0812fb336ce61790e6ed126b9fe99562bd0cd3d48b97372787ee08f772b70cd7c3426a48a8055cd9a736a3e6d13866750fa0fe
SSDEEP

1536:NIvfj0esrS653O0UMccshsEVUF0dDLc9RDdpIGrvGGZG:avfj0eS3O0rGsE40cTDTIW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01c1476a15d8173367a262a300e22886_JaffaCakes118

Files

01c1476a15d8173367a262a300e22886_JaffaCakes118
.exe windows:5 windows x86 arch:x86

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ