2dec82359fef559fea6016dc0cc9ace4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2dec82359fef559fea6016dc0cc9ace4_JaffaCakes118
Size

295KB
MD5

2dec82359fef559fea6016dc0cc9ace4
SHA1

d6c340d8b75001880887915157fc6f14013c88fa
SHA256

e2f508c33673c015b7eebd0b497e789b4f122f13af80b6e91368147ffd867f10
SHA512

463f28e156a71d2128a1af3a02c6e6ab5d74c3944ae549b30d0bb11402d170e37d9bc86f436345c9637378172f5d7babd75c5d7e1806985349c3d4d973e44ca1
SSDEEP

6144:vWJMNFEb07nKjYpajVubdRBWEYKagIXN4DDjuszFjtZzIrnlu:vqMNOQrN8VubdPH074DnuslTUlu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dec82359fef559fea6016dc0cc9ace4_JaffaCakes118

Files

2dec82359fef559fea6016dc0cc9ace4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 255KB - Virtual size: 784KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ