d1b3081a636169e5848796b021d3a665_JaffaCakes118 | Triage

Sharing

General

Target

d1b3081a636169e5848796b021d3a665_JaffaCakes118
Size

742KB
MD5

d1b3081a636169e5848796b021d3a665
SHA1

c21354fb6d57025cf78858d6f56d7a50070bcc90
SHA256

56c74ddbfc9aa198469fb850087f4da61b84a6988b0785cdd77a106126088716
SHA512

db10e4e8db2d14c13ec350ae8528462cfdc2df5ac869a439572efaf7e0670563938eca6595ef2cb5bca6147b8bb1693337f3f1ba9122d55b3529de42b24fe3ba
SSDEEP

12288:wI7XNvs/CX0dSTw5ROPcE1l3EOwQEtCFCCS9pCc4RUOoOMTozFrx4JLNuUGh2lAY:HvsKX0EwiPcKl3utCFdbcrOoOMarxoc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1b3081a636169e5848796b021d3a665_JaffaCakes118

Files

d1b3081a636169e5848796b021d3a665_JaffaCakes118
.exe windows:4 windows x86 arch:x86

325df2a7632fad14473364b374471f0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext
LoadResource
LockResource
ResumeThread
RtlMoveMemory
RtlZeroMemory
SetThreadContext
SizeofResource
VirtualAllocEx
VirtualProtect
WriteProcessMemory
lstrlenA

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 566B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 733KB - Virtual size: 733KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ