fe9e876ea01770dcd52628f23fde1a61_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fe9e876ea01770dcd52628f23fde1a61_JaffaCakes118
Size

78KB
MD5

fe9e876ea01770dcd52628f23fde1a61
SHA1

fe3780ec2d66a16dc705b15779878d4ae91a3848
SHA256

20e0072df5ab809ef6733c7707ae6ca1fca2cb7b632770637198b4011e67e9ed
SHA512

cfd49fa741ff4e6d8faf45225747e2ea3cad762747df16f2907177740f23ac70f0fcfe880532cf802f093d759c88c176e0999057f8a4dc3280cd5a8904cdec38
SSDEEP

1536:4jzyXgWwWe+NUZQqfBwHKydJGiWB/VNGXcIpsrodqF+V7lpGewlFImAEuN/kJCu6:4PywG3NUZtfUZdyVIvNLVJpksjEU46

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe9e876ea01770dcd52628f23fde1a61_JaffaCakes118

Files

fe9e876ea01770dcd52628f23fde1a61_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8acea44d8364135cd5848bc748d53860

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

ColorAdjustLuma

kernel32

VirtualProtect
GetProcAddress
VirtualAlloc
LoadLibraryA

Sections

.text
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 257KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE