0f8c901c5a966e454643a8c4247628ba_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f8c901c5a966e454643a8c4247628ba_JaffaCakes118
Size

363KB
MD5

0f8c901c5a966e454643a8c4247628ba
SHA1

1e4c146f91f8c57d1a27dd7b89c3d9fd7fa32cc5
SHA256

8164475a9f27c0e6931b7a14d070d86ccc676f2ba385dee556b0802102a6dacf
SHA512

840d1dd4f807f18eb074241a3035880f8c0c783b6d39e034943a042423e92b17c37b878b652b22d37892d1cacf3998fb6f8e8ad04c7e56154ed9ded734c37230
SSDEEP

6144:Y25xqIAxHteDiJ9AlzpXAxzd1EpK0LVfPqEBTYZiDRUabVMjUAi9BaP5biSJlOdm:Yo8Nj9Owtvu/BTYUDRUKiUAiShbHJ5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f8c901c5a966e454643a8c4247628ba_JaffaCakes118

Files

0f8c901c5a966e454643a8c4247628ba_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2717a120f3532759192746b08a75beea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
CreateFileA
WriteFile
GetEnvironmentVariableW

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 287KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE