4396c311870c0d9473e309f0c71f9edc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4396c311870c0d9473e309f0c71f9edc_JaffaCakes118
Size

2KB
MD5

4396c311870c0d9473e309f0c71f9edc
SHA1

d2406e424e4dd148592a946816b9329747db5c7b
SHA256

d58c80598aaffdecce79f86a22459096337eb99dbfbba0b354542804685deff1
SHA512

e7c3280fbe92939ea736b4455882f14a92817183cd831c8a4c2df5d6d647e0e87ef26b332acbb0717ca722ec8ee1a18350feb9ba32bccd981a75e6d59be088c9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4396c311870c0d9473e309f0c71f9edc_JaffaCakes118

Files

4396c311870c0d9473e309f0c71f9edc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a9f544e558731907efd89d1e721e5e41

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext
LoadResource
LockResource
OutputDebugStringA
ResumeThread
RtlZeroMemory
SetThreadContext
SizeofResource
VirtualAllocEx
WriteProcessMemory
lstrlenA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 2KB - Virtual size: 310B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE