16331c170f19ee7ac90170ec761516bc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16331c170f19ee7ac90170ec761516bc_JaffaCakes118
Size

11KB
MD5

16331c170f19ee7ac90170ec761516bc
SHA1

be85d217e11c0bb7bf9910b669209cc7a7c1b129
SHA256

02e74aa6f67f23b301d7ac83679de462f1d75bac2bf821f94717a526a227e213
SHA512

b63dceec1d50ff070adc9a528ea5a69b16cfa9c3c8acacce9678ee387ac2be86f7c656c19c2f2bc6487664b4d976a5fc19464ef47b372c224d759642ab90f1b3
SSDEEP

192:J3+qX1Y/51DWHwHVUuXEcQYA+hnlIEvJT:Juqq51DWHwHBrA+xlfvt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16331c170f19ee7ac90170ec761516bc_JaffaCakes118

Files

16331c170f19ee7ac90170ec761516bc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fce7809a30096dee5d325be7178490ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetThreadContext
GetTickCount
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SizeofResource
Sleep
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteProcessMemory

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ