41484455dbb9d5b59e51f15a14e20f74_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

41484455dbb9d5b59e51f15a14e20f74_JaffaCakes118
Size

6KB
MD5

41484455dbb9d5b59e51f15a14e20f74
SHA1

b594e07fcc991d4e46d6cfa0b09ef079c5871c61
SHA256

666768c3ac0c47e83858798cc06193b8e82b5e9ca8c2ac5a46c76545ea76ec6b
SHA512

ba1bb8cec5ed69aedf28d6ae9558baf709bbbce0b712c7c2b0a1bcdca862f6d7f0d58a7e3d3104a7305436f58e8229ee8b8498e1b9dba7b3bfb9f516bfb9dbc5
SSDEEP

96:QE8vafK0FN7q1K5Zzw3klhTyckOfFSf3X3X3frPf3wD:QxvoKAppukScfNSnTYD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41484455dbb9d5b59e51f15a14e20f74_JaffaCakes118

Files

41484455dbb9d5b59e51f15a14e20f74_JaffaCakes118
.exe windows:4 windows x86 arch:x86

197c8cf4be92491805c28cf962a6ed78

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

LoadResource
CloseHandle
CreateFileA
DeleteFileA
ExitProcess
FindResourceA
FreeResource
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
GetTempFileNameA
GetTempPathA
lstrlenA
LockResource
RtlMoveMemory
RtlZeroMemory
SetFilePointer
SizeofResource
WinExec
WriteFile

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE