325b4c30313111c61878e79cb06cc4e5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

325b4c30313111c61878e79cb06cc4e5_JaffaCakes118
Size

354KB
MD5

325b4c30313111c61878e79cb06cc4e5
SHA1

52d958082f6ba7cced58efb25ac7309120af2a49
SHA256

29f908afe5ddc5ab2452282d10ecbd54dfd633d2fed755f1520ec06c9039e3e5
SHA512

f43736e85ba7eb9571dd35d21d16829059c2d5a051c97243dece8a2bdb766c38f6dea592b25440277893548a9dfb91fd84ebc047d649d554504a2997e7be933d
SSDEEP

6144:oNW78FsXOv1p3phL4LW/9C/dygh6SA22BNYvKal6216SVvsLtuSxlhf67K1z1nsv:z76oOv1xsLW/5ghyYlguELVlhS7Cztsv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
325b4c30313111c61878e79cb06cc4e5_JaffaCakes118

Files

325b4c30313111c61878e79cb06cc4e5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

dae2264e721d7c66f7fa35e864d11aba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA

Sections

.Kaos2
Size: - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Kaos12
Size: 350KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mumaba
Size: 22B - Virtual size: 22B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ