0064e0e78bf67319a1afbb5600ea90f9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0064e0e78bf67319a1afbb5600ea90f9_JaffaCakes118
Size

333KB
MD5

0064e0e78bf67319a1afbb5600ea90f9
SHA1

3578d48d6016e2ae71a727c39bbf19e71248b380
SHA256

4dde903b5d7608bf19b6a099e21847ecf08b0de8376a319bea3f5a909f84bce3
SHA512

b503317359347797277f84af5b0889525b66da052084caeb1e6a7e63aa7abf47c4b2ff56919003040c6be8970e0d583706798eb8e5d7b66e543b45805ebe4204
SSDEEP

6144:tAi/TimSLmj9GuR6jWnR5hyaWmOAAHkRtzrG1l6aFo6ydBLEiN7Bj:tAiumSLY9Gu8jWHhyaWmx4kvfaFxK/j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0064e0e78bf67319a1afbb5600ea90f9_JaffaCakes118

Files

0064e0e78bf67319a1afbb5600ea90f9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

46b0675c1fd7681c7b19a1c83d5aff83

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 293KB - Virtual size: 796KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.asprsc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DDD
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE