1b485ce102135818907cb7637382eda2_JaffaCakes118 | Triage

Sharing

General

Target

1b485ce102135818907cb7637382eda2_JaffaCakes118
Size

320KB
MD5

1b485ce102135818907cb7637382eda2
SHA1

7364dce69791675d1626677c60c738fa03a4d94b
SHA256

774990225191a9890e748e166c2d00cd2141f967af60d84c24c3a746258d691b
SHA512

44be7a9c978c8259c0f0bbafc1436799f55ca6721c920cb7fbecc4da30fb15ff7a7486c00c5e53ea5a7c9ecb936b24b49f8918d9b041df3fb2680837c40a5195
SSDEEP

6144:IcS+WZoyN1SmCOx/qQYw/vO4g1JNIKmfUY1+EC1n0yHN5Dbmn:qJ88tHvOn7qKO100yHzan

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b485ce102135818907cb7637382eda2_JaffaCakes118

Files

1b485ce102135818907cb7637382eda2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

99f5b0b723d6fca2813f516623081e1c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
GetLastError
CreateMutexA
LoadLibraryA

user32

wsprintfA
MessageBoxA

Sections

.Vipgz
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.JDmS
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.YkDS
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HGD
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ