4b32432a37fb43a933468528d3686475_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4b32432a37fb43a933468528d3686475_JaffaCakes118
Size

748KB
MD5

4b32432a37fb43a933468528d3686475
SHA1

b1acb68b90ec291180405ff7c42773e8b5f01a4c
SHA256

17cb448516c9235717e8a9d3872f08b1707a87162b5c2c1de04e31f1f9a67959
SHA512

05adcfe7a976c90ed296e103a17cec593a1a41043114b1f84dcc005072ca2aaa4139f32711b16823a63d6c1f07f1373bb717e0d48eb419503db3461de60adca5
SSDEEP

12288:xJ9HZ8kSx398A+6FG1zPP8bKphUsRe6jlCu2ysFGuSeu+Zp3rOPr1f87rIWfhf:paRx+Kq8bKpK6jWy+Gu+wp3rOT1fWjhf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b32432a37fb43a933468528d3686475_JaffaCakes118

Files

4b32432a37fb43a933468528d3686475_JaffaCakes118
.exe windows:0 windows x86 arch:x86

4bda570ce112adc211f3bd7fa6b82f33

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetModuleHandleA
GetProcAddress
VirtualProtect

msvcrt

malloc

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.QW0
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.QW1
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.QW2
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xiaohui
Size: 6B - Virtual size: 6B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ