25fdc60d431d72d27b4b54a548b8750b_JaffaCakes118 | Triage

Sharing

General

Target

25fdc60d431d72d27b4b54a548b8750b_JaffaCakes118
Size

598KB
MD5

25fdc60d431d72d27b4b54a548b8750b
SHA1

8fc984de445bd19f179e40a8f7fda88178f21ef6
SHA256

8f67e42e2ca84519648560fc2004c8301133ce40518dbed8f66dba6b048d0f4e
SHA512

25e79f95b4361594ea98cb75c130b2cc3fe0cca69c34760d72ccd60d0e472da5202ffbb6b340ba0ba182e26debfc17fb93e6455a1253b4f4c2b91a8d63460f0d
SSDEEP

12288:CoNFHAcSHwfzkYosJmDI7Od8xh2QTlipTqzClhPJF3euCJJa:LgcSHyzkq2IiQ8pTWClhPJFuuCJJa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25fdc60d431d72d27b4b54a548b8750b_JaffaCakes118

Files

25fdc60d431d72d27b4b54a548b8750b_JaffaCakes118
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

6e1f282449492d5fc7a87e6f1c3ced5d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LocalAlloc
LocalFree
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualFree
VirtualProtect
GetModuleFileNameA
VirtualAlloc

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 585KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ