600453676ad3483267516fcd4fa93389_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

600453676ad3483267516fcd4fa93389_JaffaCakes118
Size

1.3MB
MD5

600453676ad3483267516fcd4fa93389
SHA1

6b28e84544dbf0cea6f970e3d3ed8f3c1a813d01
SHA256

6857b11f48f1f7b7e1cc78bcd833c68a7ada8d3eeff56ba54aa94115cbd7cd5f
SHA512

a00c632b32fdb894e18c9a2589e19751d185ead9edc0134fbe085cea2dbecdc81d3ff1f99427cce09a6176ed9418c8534f67c882dedbb75d40db2a8403595566
SSDEEP

24576:tbCTohN9SMTHODaQpQPjZkgbrfc8Ugv3bjrxe6uxkYv6hrF5i1pGqKPCZdi5DZV:tuTohvSguD2ZV3f3k6uIhSHGqsCZCj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
600453676ad3483267516fcd4fa93389_JaffaCakes118

Files

600453676ad3483267516fcd4fa93389_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c0ca8fb524d53a294a75f3adfde9e816

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
ExitProcess
GetModuleFileNameA

user32

MessageBoxA

Sections

.data
Size: - Virtual size: 16.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ