26b2badc2b3a25e613a61276cbc3e929_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

26b2badc2b3a25e613a61276cbc3e929_JaffaCakes118
Size

53KB
MD5

26b2badc2b3a25e613a61276cbc3e929
SHA1

27ab29ce3433c7a3046a7fcf034f7c529b5cd50a
SHA256

4ac6c105242bcf19d3ee349d09b2703c1106d401e864e4bfc998f75717609545
SHA512

1f4d9e15f943d26aae30ad6a57682c79ed2bce8f09347a2c2153c2861267bd36b5a3769cac28608569e38ae58e3a9a4f109d5fc356b5f2328c811ca88ab1e26f
SSDEEP

768:4e7BFSno3kxoacl8pKkzU7cJM9CoamH8EdzC+8r9PyISIFDOTM9XonmH8E:1FjUxoaZpXU5cECISktmcE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26b2badc2b3a25e613a61276cbc3e929_JaffaCakes118

Files

26b2badc2b3a25e613a61276cbc3e929_JaffaCakes118
.exe windows:4 windows x86 arch:x86

732ca56cf56a98372da8c2abc92a9622

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
GetLastError
CreateMutexA
LoadLibraryA
lstrcmpiW
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

wsprintfA
MessageBoxA
wsprintfA
MessageBoxA

advapi32

LookupPrivilegeValueA

Sections

.data
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.werty0
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.werty1
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE