1a9414c092349e72667b37892a180a86_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a9414c092349e72667b37892a180a86_JaffaCakes118
Size

291KB
MD5

1a9414c092349e72667b37892a180a86
SHA1

de1f70610b2886f7a3a3524ed135d1f56eee916c
SHA256

b16b0c5b36ea7624a0cf71ef0544f54554e5cfbbc00cead19e126edf2777f6f4
SHA512

28effa2a9d32d1a6d346e8c4b4bdc38d9802e629600e092e57d54cd773b39bbf8a2fef1d80a8cb4ac3ae981d9711c482873229de20076446193a8f6b115b05eb
SSDEEP

6144:pQccOgjWtQufKgBCpz7PFGzGOgJl99NxMBaGPmK5qAprqVYrBG8:pLc2tQWAp39GzGOoNOwAp8Yrh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a9414c092349e72667b37892a180a86_JaffaCakes118

Files

1a9414c092349e72667b37892a180a86_JaffaCakes118
.exe windows:4 windows x86 arch:x86

240a55fac3d44e10362c894c11dc76d3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
CompareStringA
GetNamedPipeInfo
GetCurrentProcessId
IsValidLocale
CreateNamedPipeA
DuplicateHandle
FreeLibrary
GlobalAlloc

user32

SendMessageA

Sections

swiIAmul
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

FuCMnhUi
Size: 1024B - Virtual size: 622B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

btlkmvBB
Size: 260KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE