189a44a8fc2960e883106b7606c7b553_JaffaCakes118 | Triage

Sharing

General

Target

189a44a8fc2960e883106b7606c7b553_JaffaCakes118
Size

369KB
MD5

189a44a8fc2960e883106b7606c7b553
SHA1

3e35f95edee72fa80783aff8a91209ddffbe5992
SHA256

7c126e3654e4218984eb38f007dc572b8f168a3abbb185bb2011a19a7bf4a4f7
SHA512

71520033be477ff782850708606be2e1399b05d72cedf0e8fdfdfb9095533e49aaa42eee40bc4f3531f61090d745684ea09256f6ff66c950f0ca6c734d4e028f
SSDEEP

6144:4yReXiTj+cXsdIHVQe20Ekde5hPq8dK/HSKCJmg1q/a2C4F+DqmVwY5Ghl:4gHVZHVYhPqIK/Hgmg12a2E//5i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
189a44a8fc2960e883106b7606c7b553_JaffaCakes118

Files

189a44a8fc2960e883106b7606c7b553_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 361KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 184B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

jxq
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE