02dc8471c5a67c132258c48dae499644_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

02dc8471c5a67c132258c48dae499644_JaffaCakes118
Size

381KB
MD5

02dc8471c5a67c132258c48dae499644
SHA1

27f058cbf374a51fd4c6bdf888feeaa0b94dc78f
SHA256

cb3dcddb727f7c57a4e41f60ed60a7bd0ee3515e0052ec89d1ff52aa17548dd5
SHA512

e424d1510a01b50a89d80834df0428b29d5d225339bd7fc614e07773738683b5e3673d23dc595550fef68c5bd7423d5a761fac365b7af1e98184b22b56d1eb55
SSDEEP

6144:ekgTm5Cxmk9KVwHGwmnpuDAjxhSreWRPAwxA+mn9wo2LEi+U/vqSuB+D2EfX5bg:ekgC5CDKaHGbSZPRPHxA+mn9/qJF/vq0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02dc8471c5a67c132258c48dae499644_JaffaCakes118

Files

02dc8471c5a67c132258c48dae499644_JaffaCakes118
.exe windows:5 windows x86 arch:x86

dae2264e721d7c66f7fa35e864d11aba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA

Sections

.Kaos2
Size: - Virtual size: 380KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Kaos12
Size: 377KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kylin
Size: 1024B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE