f3aa60918b312405ad166b1aa7be9335_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f3aa60918b312405ad166b1aa7be9335_JaffaCakes118
Size

299KB
MD5

f3aa60918b312405ad166b1aa7be9335
SHA1

02de8e10387c726e41cacff488bda004fa051e54
SHA256

e65ee8005a0c317e2838112cc08787f1c585a69fc42586e3af9192efe9404108
SHA512

289abf9613484cbe8f35bcf0c602835732581fc2f14195cfd3440199e3835508be424f3ea3d5dc8fcc8b72a7f5e7cc770a52ba6259e3c1074d1ffd3c5d9b5ce0
SSDEEP

6144:a2K5i9d0oFyZ0Y3iV+NUrzLFEZ5Z5ti6RwmGA+XVq5B8uiwvlChr03HoJ5C8Hh:D96YyKAEi3ZDDRwmGA7fvOw3H45C8B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3aa60918b312405ad166b1aa7be9335_JaffaCakes118

Files

f3aa60918b312405ad166b1aa7be9335_JaffaCakes118
.exe windows:4 windows x86 arch:x86

acb387b3aee05e4a50ae55599974df99

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualUnlock
TerminateProcess
ExitThread
GlobalDeleteAtom
CreateProcessW
EnumSystemLocalesW
GlobalFindAtomW
DeleteFileW
GetProcAddress
EndUpdateResourceW
GetModuleHandleW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ