264640495209627fa2892854292bf88f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

264640495209627fa2892854292bf88f_JaffaCakes118
Size

85KB
MD5

264640495209627fa2892854292bf88f
SHA1

2fe6b23101dc657e760836fe506255a4547622ad
SHA256

c4a924d6a2ed600102ef5bf76e288200837c1139be7503f29a002972e1fb60c3
SHA512

3ad17242824e5fb2faec56a61a94826fa841c0df6155d25b2b447d8fc7fd51b464bf0026744f13425b6df7877959e8b3a9ccebf9b57a2b3b2d06e9b49ea087ae
SSDEEP

1536:NSaIBPqcR5eVUtn9IUW/hPV3J7G44edZ1dEgOh0eqOTpmn7B0NB1i6x4RD0SVT:NS5BicHem4FV3J7V4InOh3qOTK78viUq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
264640495209627fa2892854292bf88f_JaffaCakes118

Files

264640495209627fa2892854292bf88f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1901fa132c99a01befe01f9af3f73cf0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCommandLineW
GetThreadContext
GetTempFileNameW
SetThreadContext
FreeResource
FindResourceW
LoadResource
CreateProcessW
WaitForSingleObject
GetModuleHandleW
GetTickCount
VirtualQueryEx
WriteFile
OpenProcess
SizeofResource
ReadProcessMemory
GetFileAttributesW
CreateProcessA
TerminateProcess
GetModuleFileNameW
CreateFileW
lstrlenW
GetTempPathW
GetProcAddress
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
LockResource
Module32FirstW
lstrcatW
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
WriteProcessMemory
ResumeThread
lstrcpyW

shell32

SHFileOperationW
SHChangeNotify

shlwapi

StrChrW
StrRChrW
StrCmpNIW

msvcrt

free
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
malloc
memmove

Sections

pe
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ