f4e67b24875e87ab23c94c8f38cca077_JaffaCakes118 | Triage

Sharing

General

Target

f4e67b24875e87ab23c94c8f38cca077_JaffaCakes118
Size

169KB
MD5

f4e67b24875e87ab23c94c8f38cca077
SHA1

f5ad3947f471a01d921535787a4f95c8d98e5e44
SHA256

4ab3e5958daf16634a93790718bdc76841b54fdaa682134d81f91fe245001213
SHA512

d29398228be90dbd4aec2994dd81268c8227baac34bb1418c5b1ac4542a8d91fe2961aeb834961dcf69684db4eaaed9d313c718d38976cb75f5a48128f66730f
SSDEEP

3072:vsHuQMSSb/FxsCDk9Ys2IUT5ME0i4oYw+dgffXb4iujGdzWMpz76bMSbZ59LR:EO76Ce6IogiHBv3ld6MpzuoSbZ5z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4e67b24875e87ab23c94c8f38cca077_JaffaCakes118

Files

f4e67b24875e87ab23c94c8f38cca077_JaffaCakes118
.exe windows:4 windows x86 arch:x86

26f9ea1bcc566bdd8da35e86b79fffaf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetCurrentThreadId
VirtualProtect
LockResource
LoadResource
FindResourceA
LocalFree
VirtualAllocEx
GetCurrentProcess
ExitProcess
GetModuleHandleA
LocalAlloc

ole32

CoInitialize
CoCreateInstance

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ