5ff26cb2f97bf9050d1c3d6e9fb2b6f7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ff26cb2f97bf9050d1c3d6e9fb2b6f7_JaffaCakes118
Size

572KB
MD5

5ff26cb2f97bf9050d1c3d6e9fb2b6f7
SHA1

4c709c1f835d380f1b2cdaa24878bdf98e4a6afa
SHA256

279b7e20abd5280253d54bf605d7c1534eb748668b9345652a30d4d9a4d20b54
SHA512

8b2376a3ce227b9e860e578af54dde9d804490afcfcd0052e33df44f6688ba85f09a7124bb5d6e0a35a08a2f8a584a038e80f17e50c2d8cdef74c87091d874c8
SSDEEP

12288:ZgxJj069XeySKmsnGXqpfkQcfVCSbt2NSsyHE+:Z+uyS9qpsZTsQsyHE+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ff26cb2f97bf9050d1c3d6e9fb2b6f7_JaffaCakes118

Files

5ff26cb2f97bf9050d1c3d6e9fb2b6f7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

48343d7e5817f839f6442938516d094c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\coding\Cryptocode\Release\PE_Loader.pdb

Imports

kernel32

VirtualFree
VirtualAlloc
OutputDebugStringA
GetSystemTime
GetProcAddress
LoadLibraryA
GetLastError

user32

wvsprintfA
wsprintfA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 807B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 568KB - Virtual size: 568KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE