edecdc592064db099b045c195b8afb42_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

edecdc592064db099b045c195b8afb42_JaffaCakes118
Size

372KB
MD5

edecdc592064db099b045c195b8afb42
SHA1

a0f2e99adbb218ace9a810a4af6aa74730ae8064
SHA256

24aa23f61b1065b68d9328733501fb0aa82710d10dcfd1fe3011aa8230979493
SHA512

ba315adbd0ee9c0f1df433615dff8bca4c6bde8b00cdb3a697ca54e2225bbcbbf47c28937d71d4999986e9b18166d9d6f1f9da75aa59c97bcda8c54370f8bdeb
SSDEEP

6144:996qpOod0hDJRu240ldn/PQ8GVzyexTtZk5dRS3oszBKB0IexDsPXEzj2ei:996hTDG24on/47VzyH5dRS3fBKB0D3ze

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edecdc592064db099b045c195b8afb42_JaffaCakes118

Files

edecdc592064db099b045c195b8afb42_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 166KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 924B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ