2875ceae0315064f4a1762169f9cc965_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2875ceae0315064f4a1762169f9cc965_JaffaCakes118
Size

686KB
MD5

2875ceae0315064f4a1762169f9cc965
SHA1

cae6f61680d8e81f19a68a6982f46099cfca4614
SHA256

a4cf1dc0c45a0bb19c6ab84aaf23948197afd1b5c9d59d5b546279f922b77135
SHA512

389932efd41b7df7461d96c74ce4b25d12e0cbbd46d61fda289562d8f2e42a8e70e96c61bed431624318ba329b5e9ed69e1c2087352f32de616ca3800992a626
SSDEEP

12288:h/NMtyzGWQRT/l8pmqxaUxUrogH0ZaVuZfTRnygelcdavKwRw0y4OrX:xNeyxQRT9qjiFH0ZBhdy7SaC+7urX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2875ceae0315064f4a1762169f9cc965_JaffaCakes118

Files

2875ceae0315064f4a1762169f9cc965_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c0ca8fb524d53a294a75f3adfde9e816

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
ExitProcess
GetModuleFileNameA

user32

MessageBoxA

Sections

.data
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 655KB - Virtual size: 655KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ