36416357794b58e6f22135bd82949552_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36416357794b58e6f22135bd82949552_JaffaCakes118
Size

253KB
MD5

36416357794b58e6f22135bd82949552
SHA1

b76969c55c2ffcec4ecc5296e064526087bd39ac
SHA256

5f5e38aa7e9541abefd13e983210b91ada3755ac62d5076f4ef2bd8eaa77fd0d
SHA512

a94c32c502de3548de0783ef41430a165a7f9a0d2ee547b6be3b9533a2bd3f7bd018de4b6a16a0dc49c76eac2ece039b345775a6aea342da723d30db3c5d9e71
SSDEEP

6144:6eXyCXZRpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKJ:6eXyCXkGLE0kuGnESBJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36416357794b58e6f22135bd82949552_JaffaCakes118

Files

36416357794b58e6f22135bd82949552_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c92746cd3b69c56e5c4ed6d3f9854fa1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
FreeLibrary
VirtualProtect
GetLastError
CreateMutexA
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA

user32

MessageBoxA
wsprintfA

Sections

.data
Size: - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ