2a110976dbdf48b031f54bad7ee205f1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2a110976dbdf48b031f54bad7ee205f1_JaffaCakes118
Size

6KB
MD5

2a110976dbdf48b031f54bad7ee205f1
SHA1

7319976de4b6a0e965e49a945647275180aa14b4
SHA256

0db00e9b62b58484c27494a91cf798701b63f1c3942fd93576e74a7c784ded1c
SHA512

cd7f5f53552bf674a4831667c299ec8872c9218596245487fcada8e7d4a8e217ca6004cabd1e39e7d5a735a484e7bafdbd72a9543baef2eda2abeaafa9fc5456
SSDEEP

96:VuEJVcAM50LBDmGHx9Hf9OEHMrYtomI9mfhVWUWCE/I6CWV9:xJSULFmIxN9zyyzh7Wf/LCW/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a110976dbdf48b031f54bad7ee205f1_JaffaCakes118

Files

2a110976dbdf48b031f54bad7ee205f1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

36fa43dbe3114afa89b5735981ee659e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
CreateThread
GetTempPathA
WinExec
GetModuleFileNameA
GetProcAddress
LoadLibraryA
FreeLibrary
Sleep
CloseHandle
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
DeleteFileA
lstrcatA
GetSystemDirectoryA
GetTickCount
TerminateProcess
OpenProcess

user32

PostThreadMessageA
GetMessageA
TranslateMessage
MessageBoxA
wsprintfA
DispatchMessageA

msvcrt

fgets
strstr
fopen

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ