4c36717475cdb72c5cbbc32c69c19e44_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4c36717475cdb72c5cbbc32c69c19e44_JaffaCakes118
Size

100KB
MD5

4c36717475cdb72c5cbbc32c69c19e44
SHA1

033ad56209a394cc37796ef37c044b9249696790
SHA256

f7259a22c12634e16c57d744bf12d5886d1bc66cb6c3048383530593e729cd5c
SHA512

a196f30dd29785ea73ab4a543355067fb407aadb45f3fe90df625c6a01bf3b8630821e4c5b480f82cbf9045224afd5d13239d95c610a87bb635b7bcdd630a8ac
SSDEEP

1536:OdlTMtN7iwkSjOh9qqHseh4phWtIp5HPGH7ytdhqPzQ0Eq3zdpYnSHjVRnvTRJ:OiN7OEOhcMkStIpGWtmPzJBBNvj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c36717475cdb72c5cbbc32c69c19e44_JaffaCakes118

Files

4c36717475cdb72c5cbbc32c69c19e44_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8fd82e8d3bb8eb9dccfdbf29d39d96fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
ExitProcess
VirtualAlloc
GetProcAddress

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 342B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ