42afe095767d8a21a552985982874234_JaffaCakes118 | Triage

Sharing

General

Target

42afe095767d8a21a552985982874234_JaffaCakes118
Size

221KB
MD5

42afe095767d8a21a552985982874234
SHA1

31621748ac403462904ab50a955e9e8e972310d6
SHA256

442e98f2a095b963b4a73c780411d2fa35adb5c3b1f3ac6d1029e1845f6613bc
SHA512

33ec5677cb4c126eb22e21bddf16400ce4ba1297ae887bb8eade064cc2db0544cf42299418b97d422a8551c53b02ae9d7c4f88123b4372c9d1fc75405ba3ade8
SSDEEP

3072:FLhgj1KiLc3OIkSCiuYyIyu99eQH6v5pBzD05y5zU7H/Gv+hkkzy:FVa1KiLu/knijyIZ9V6v5jo5y5afIkzy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42afe095767d8a21a552985982874234_JaffaCakes118

Files

42afe095767d8a21a552985982874234_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5fb34ba92ec7f5f859e799eccd01683c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

TranslateMessage

gdi32

DeleteObject

advapi32

OpenProcessToken

shell32

ShellExecuteW

ws2_32

WSAStartup

Sections

.text
Size: 186KB - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE