31072f684dfbdab95b9f05f08ab1f7f6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

31072f684dfbdab95b9f05f08ab1f7f6_JaffaCakes118
Size

256KB
MD5

31072f684dfbdab95b9f05f08ab1f7f6
SHA1

161f7baad0ad0055b86ad7b4ff0c632747dd7b2d
SHA256

328dc6d61ddc2a943f192c90cbb68edd84b6ba56c2fe5654ecae7d9f9f8db003
SHA512

b04fefb20db7c4df87ae2751604fc59a80ff1bbadbd67ae85df40073414debbaecc10a1fad7b2dfbc96d58461c309578f4130f0e0a8c0de2bae23006c67022db
SSDEEP

6144:0gsQ3tNrSDmbL53OrbO5rvkQ+DjTBSVH7v1PxFMv29ZfhD/VYHLwGl:TBt+mX9OPG3+DjTIRpxe2ZfhDNKEs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31072f684dfbdab95b9f05f08ab1f7f6_JaffaCakes118

Files

31072f684dfbdab95b9f05f08ab1f7f6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 221KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ddd
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE