fde662a35920ac8042e2dd1aeb4895bb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fde662a35920ac8042e2dd1aeb4895bb_JaffaCakes118
Size

221KB
MD5

fde662a35920ac8042e2dd1aeb4895bb
SHA1

2be0800a1e6b7509cf0f57128f3e572a500a40ec
SHA256

7921f55ec8ac12f1b45e98c8b12701392baae5628833adcbadc5a995e39d732e
SHA512

f33c276e9eef9ca6a91dab6529f54aec1085ee4da4a9165864980f43646767e3fe15b95cf59a74cf7ab6d30983b9d9974ab172f828348af5b103945b35754578
SSDEEP

3072:FLhgj1KiLc3OIkSCiuYyIyu99eQH6v5pBzD05y5zU7H/Gv+hkkz9:FVa1KiLu/knijyIZ9V6v5jo5y5afIkz9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fde662a35920ac8042e2dd1aeb4895bb_JaffaCakes118

Files

fde662a35920ac8042e2dd1aeb4895bb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5fb34ba92ec7f5f859e799eccd01683c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

TranslateMessage

gdi32

DeleteObject

advapi32

OpenProcessToken

shell32

ShellExecuteW

ws2_32

WSAStartup

Sections

.text
Size: 186KB - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE