639a71f861b5bc0fdd83cde05ce68b73_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

639a71f861b5bc0fdd83cde05ce68b73_JaffaCakes118
Size

102KB
MD5

639a71f861b5bc0fdd83cde05ce68b73
SHA1

e2334f69af9b415e7e5ef84eaa17409033dff2a1
SHA256

257c0c02754aca27ab8b432024e09b302a654098d9afa6eb29ef12f13b369a3d
SHA512

145cdec82362c481120d1b80986abb0e7b7ec4b843130d270dfe8bfd5180879e5218a730a880999834d1d30a7d42e67ef823e929213db38f43383638c2c2edf9
SSDEEP

3072:ycQvZdCY9sQF5or/Vn6HmksLjo3NgKI55JC:yLdzF5or/Vn6ToIE5S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
639a71f861b5bc0fdd83cde05ce68b73_JaffaCakes118

Files

639a71f861b5bc0fdd83cde05ce68b73_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6e1f282449492d5fc7a87e6f1c3ced5d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
LocalFree
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualFree
VirtualProtect
GetModuleFileNameA
VirtualAlloc

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 93KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ