499965cbc677449ce50076392483a775_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

499965cbc677449ce50076392483a775_JaffaCakes118
Size

2.9MB
MD5

499965cbc677449ce50076392483a775
SHA1

fa1c25cdcd179663cf296bb0aed9bb70d18efbe7
SHA256

725df217ff4f2d91be4db4be87bb4a35db4473b50d76686330e638edb77a1d8c
SHA512

d95a637d32222bf703e5d36e5bd244d61f67a0ed5150abc1b9b44643660be7d23c4001aed49018274a480ed7f53e0aa282f3168c5ff7096b5515eb47789745e0
SSDEEP

49152:SC5nZkw7IJcJTX2GOtmrM3Pk2bKD6K1OYJ7KhNbzNP/V1dlyHLcPxARdrPNK4:SC5awFNX2Gi3fKr18nH5/TdfZ2rPo4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
499965cbc677449ce50076392483a775_JaffaCakes118

Files

499965cbc677449ce50076392483a775_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aa77d18b40072a7e1dc36630aafffd27

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
LoadLibraryA
VirtualProtect

Sections

.XPack0
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 10.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.XPack
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE