fb3621cc949fd9fdda6a77605c2106a5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb3621cc949fd9fdda6a77605c2106a5_JaffaCakes118
Size

47KB
MD5

fb3621cc949fd9fdda6a77605c2106a5
SHA1

ae64242630d853bd85203b21202e78532dea3760
SHA256

b9532639d5368e0623ae0d8e80e56b58d7b83f1ad09f9c04331b3f7694de89c0
SHA512

a6ccf07e7783931d3167bef8c28d8541fdf760c7ca7eef6f4ecaca126ff00871048ede3dac04002faa85f06967b115792c0c7a3f4f25622ace2a0a893260f4ac
SSDEEP

768:dD0HIKo0MJmpDibJ9vcdLYQhnK/2EXibuPGhyOiJ0G+k9BBntwIpB:dD0HIKzMJmpwJwLJnKOEycGhyOb0twID

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb3621cc949fd9fdda6a77605c2106a5_JaffaCakes118

Files

fb3621cc949fd9fdda6a77605c2106a5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

119ba01abad812c4a461368344bcd6cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleA
GetProcAddress
LoadLibraryA
RtlZeroMemory
VirtualAlloc
VirtualFree
VirtualProtect

Sections

.pepsi
Size: 45KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

n-coded
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.af2cd
Size: 331B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE