0c8a4921849df0046bea3b9dbefd80f9_JaffaCakes118 | Triage

Sharing

General

Target

0c8a4921849df0046bea3b9dbefd80f9_JaffaCakes118
Size

12KB
MD5

0c8a4921849df0046bea3b9dbefd80f9
SHA1

8a618e17320d10f486861babb4feaede3898f2c2
SHA256

633e54c489c854ad722253551e490e4435e3d9c9e002da12bbcc0de1509c540e
SHA512

e3793852c094d5c81684af548388bccd199c5dcbc05bba9b63123a0a92cfbb85ec1208e26a175965f51ca1fa6d36c152ab5af279d621909cf03de65b17e7633e
SSDEEP

192:en31R5Fhp8cdwpHR3AkPLiM79mLU2PcSe8hcqm:oj5FZdgAkTiM79mgLSeScqm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c8a4921849df0046bea3b9dbefd80f9_JaffaCakes118

Files

0c8a4921849df0046bea3b9dbefd80f9_JaffaCakes118
.exe .vbs windows:1 windows x86 arch:x86 polyglot

2ed0b6e28b1e742765ef39a145eeeeec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
DeleteFileA
ExitProcess
WriteFile
GetCommandLineA
lstrcatA
GetTempFileNameA
GetTempPathA

crtdll

_mkdir
_getcwd

shell32

ShellExecuteA

shlwapi

PathQuoteSpacesA
PathAddBackslashA

user32

wsprintfA

Sections

.code
Size: 512B - Virtual size: 393B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE