0f6183170e871aff9166e46cd582d0e3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f6183170e871aff9166e46cd582d0e3_JaffaCakes118
Size

4KB
MD5

0f6183170e871aff9166e46cd582d0e3
SHA1

2977d75180af30caf0997996927e6cfdd4154e43
SHA256

6d733da801d1bf1b1dd7fd0da189db890c6ef75679897c17dec5337f60306798
SHA512

bd329c8dd1d3f5b3461cc41b297316e633519211127f75f744c23772775870c80516ace09b766984d47559221a9b24b1bc4b20b3862cab69e1893839675c840a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f6183170e871aff9166e46cd582d0e3_JaffaCakes118

Files

0f6183170e871aff9166e46cd582d0e3_JaffaCakes118
.exe windows:1 windows x86 arch:x86

42bac0c1fe7d999753d5333afb9cf2b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateRemoteThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
GetModuleFileNameA
LoadLibraryA
OpenProcess
Process32First
Process32Next
Sleep
VirtualAllocEx
WinExec
WriteProcessMemory
lstrcmpiA

urlmon

URLDownloadToFileA

Sections

.code
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ