35788c053f2ad5e74d091532c5231ae3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

35788c053f2ad5e74d091532c5231ae3_JaffaCakes118
Size

412KB
MD5

35788c053f2ad5e74d091532c5231ae3
SHA1

52d9f1b23b1bc0d5a88881fefbd2ceb731de0ed3
SHA256

dfb08bb120f135da5bee4321682735bcbd08ea13304eb305261f7d5750e2a8b6
SHA512

163e772dac3e41914386b5429045fbdf9e1055c8d8a01d48a4da30a71d2ee942d42eb471fa6dfaee889611a91c289be00eb562476299ef84a2573d93d09f9b56
SSDEEP

12288:l0ncUbpNi5YjKSfFtm8CCgziacu69Bsgei:Gcwp85WPfFAcNz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35788c053f2ad5e74d091532c5231ae3_JaffaCakes118

Files

35788c053f2ad5e74d091532c5231ae3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

dae2264e721d7c66f7fa35e864d11aba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA

Sections

.Kaos2
Size: - Virtual size: 404KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Kaos12
Size: 408KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ