f407b22f321beb780259c2554da60c31_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f407b22f321beb780259c2554da60c31_JaffaCakes118
Size

235KB
MD5

f407b22f321beb780259c2554da60c31
SHA1

b18f0195e9b8554cc2a521f01ad3a745372d9a34
SHA256

2bd257cd4994f9d4705c0877d88a7533b0d32cc30c3b8663e67ffc6383064df8
SHA512

e1eb512f98f20f644a292b1790dff8b4211f40c76ee967287ba77463e2e0252d20b65958d22c07d0be54626dc138c7b9dd424082a51077e55616056f69fab7e6
SSDEEP

6144:gbkX4YJ8sSPsIBja0ICuTv5q4tJ5yxAP3iALv3HsmT:wkI28sK1nICI5q4VuAPSc3vT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f407b22f321beb780259c2554da60c31_JaffaCakes118

Files

f407b22f321beb780259c2554da60c31_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2717a120f3532759192746b08a75beea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
CreateFileA
WriteFile
GetEnvironmentVariableW

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE