4c0173d2d89250aadae8a3b9bb3bb299_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4c0173d2d89250aadae8a3b9bb3bb299_JaffaCakes118
Size

85KB
MD5

4c0173d2d89250aadae8a3b9bb3bb299
SHA1

d628cc70b5e45a40ae6d16404be6035a625e875f
SHA256

002f84cc44625a6571913b15b666f65f1568fdd65c62184a5be07d40a0272157
SHA512

b31d818ffc57432058b1d9fe7128019b36b8d969e796bc11e4deebb87dd98f185fa24749e243d94d5e73d9eef4f860885ca2d39b28dbd9a9e5bafeeb1f9e2142
SSDEEP

1536:+HEqpJIatzO9Si3hnHPnMxbppA0mHwURUUwf/h:+Vp+79SiJnMx1xXcUrf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c0173d2d89250aadae8a3b9bb3bb299_JaffaCakes118

Files

4c0173d2d89250aadae8a3b9bb3bb299_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cb6d92f0229c70336af9a29ec92df78b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
GetLastError
CreateMutexA
LoadLibraryA
_lopen
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

wsprintfA
MessageBoxA
MessageBoxA
MessageBoxA

shell32

ShellExecuteA

Sections

.data
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jsf2ck0
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.jsf2ck1
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE