3f50f53a732e788318b92ca05ea69a6c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3f50f53a732e788318b92ca05ea69a6c_JaffaCakes118
Size

350KB
MD5

3f50f53a732e788318b92ca05ea69a6c
SHA1

d617cd811d99679c36244cafecff18b99836f77e
SHA256

ce895fc36bdae474d3641c19048afea3fc0ba04b1b8ee84f7ae55dc130615454
SHA512

f281aa83e2dff565a255b577fa7554860f0d300c0846e594612a623f531e998a954b5a2a8dccc1bfcd222d924d807103dcb687333b65ef3cf793e1a551647b3c
SSDEEP

6144:dvd/T0ycleKOg39WsPXL/9esTvNcQwJH1+SvTxW21xTinBToGI6aA4C+H4sRqkxW:dF70HPOg0sPX3NcFw278To2rsjJq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f50f53a732e788318b92ca05ea69a6c_JaffaCakes118

Files

3f50f53a732e788318b92ca05ea69a6c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2717a120f3532759192746b08a75beea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
CreateFileA
WriteFile
GetEnvironmentVariableW

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 274KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE