0cede25d488a35b3519c39ce7e37541a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0cede25d488a35b3519c39ce7e37541a_JaffaCakes118
Size

1.2MB
MD5

0cede25d488a35b3519c39ce7e37541a
SHA1

0897da94e3bfb87705dee20d77b5deae4eb0cfd2
SHA256

764d12f385f6581ac1b8f261f4606611d58f5d9cba9329c63ad21180a8599b12
SHA512

faa16b027939a937a0b5f771769f5d9e1c87e17f3cba74e5da8260e0b17944b9549ee4c6827a17f9000d782d130481c688b5eea6f1b67973171ea81e115597b0
SSDEEP

24576:09yYaBMbUdncY4oV/4gT6lxoZBRYtYg1skIYdWce6:tYfYncY/eTxkyYg1sMWct

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cede25d488a35b3519c39ce7e37541a_JaffaCakes118

Files

0cede25d488a35b3519c39ce7e37541a_JaffaCakes118
.exe windows:6 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 24KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE