409a6f02f8d09adbb48c241fb5676341_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

409a6f02f8d09adbb48c241fb5676341_JaffaCakes118
Size

2.3MB
MD5

409a6f02f8d09adbb48c241fb5676341
SHA1

5d35d810018557f31c2c008c9c6950d987735e0a
SHA256

6ab0644263d9557bcc5914227572fdb703a4a0abd63d3731b02a3604e5fdd4aa
SHA512

812d1ab422bb843f4e3b384418d8b6379e156ea481f90e815b1bfa6325f3a889491427339fe985854d04f855977979354787f13ec8d01aaa576af5e38d30af13
SSDEEP

49152:NckQGGIZVUjqnAVKbEsIvlFiRR9T0H+vIqWGNI+zkHj3BrE:NDQcDfng8ZIviRR9TFIgI+zkLBrE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
409a6f02f8d09adbb48c241fb5676341_JaffaCakes118

Files

409a6f02f8d09adbb48c241fb5676341_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8fd82e8d3bb8eb9dccfdbf29d39d96fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
ExitProcess
VirtualAlloc
GetProcAddress

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 778B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ