5adf667df3dfce0cf629ac45ec046737_JaffaCakes118 | Triage

Sharing

General

Target

5adf667df3dfce0cf629ac45ec046737_JaffaCakes118
Size

510KB
MD5

5adf667df3dfce0cf629ac45ec046737
SHA1

5be439f7c76913dbbff87804eb91119121a97ad5
SHA256

9e41ecb8e8afb74b8c3d34cd4df755df84a7af38def16972cea0746f3de7de85
SHA512

22428dc296453cebd78de301ff07a73195fa965aae38140d871ae3150518d91b0956b133adbe87dec49cb05c1646b9574c25c37c3f2ff081cfaa574e1d8858d8
SSDEEP

12288:xBktzE+t0bRL9ywPIiuDYu+/v8cD2ZFFnBGPV6HtvNrG2LH1fJ+Ae:xQUbuOuklMcMFIVcfrG2LVfDe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5adf667df3dfce0cf629ac45ec046737_JaffaCakes118

Files

5adf667df3dfce0cf629ac45ec046737_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6e1f282449492d5fc7a87e6f1c3ced5d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LocalAlloc
LocalFree
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualFree
VirtualProtect
GetModuleFileNameA
VirtualAlloc

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 500KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ