26b45b9405fb3474d5c08b9dc9524e35_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

26b45b9405fb3474d5c08b9dc9524e35_JaffaCakes118
Size

256KB
MD5

26b45b9405fb3474d5c08b9dc9524e35
SHA1

ee73badc2e8841de36a3650d21120da63d071de7
SHA256

e2a62988bfd550a44fcab1f5000b0749673a976f37ac25652e80078781a4389d
SHA512

7dd97633f2a84a5dec1bf2a0230e1c5e0857db0ae851ac71903480ff884b060455141d711bd0aa96cbdc68992188f80a85d8dda1fa6684bd8905cdcd6b551550
SSDEEP

6144:0yhkfus28zYkSzr64jLwlNKm0F5VSmCOMlzF:rhkNEkSzvXwlN4VMzF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26b45b9405fb3474d5c08b9dc9524e35_JaffaCakes118

Files

26b45b9405fb3474d5c08b9dc9524e35_JaffaCakes118
.exe windows:4 windows x86 arch:x86

acd9fa3a74cc4c1d92998e6ad62eeb8f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
LoadLibraryA

user32

wsprintfA
MessageBoxA

Sections

.data
Size: - Virtual size: 676KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RCryptor
Size: 41B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ