68891a6b8224e410c8128300104aef76_JaffaCakes118 | Triage

Sharing

General

Target

68891a6b8224e410c8128300104aef76_JaffaCakes118
Size

180KB
MD5

68891a6b8224e410c8128300104aef76
SHA1

45420c01786b20ec31329240d209d4f029def163
SHA256

0d9c534a19768845bb6f3eeef907ee56e7930156a1d20d4e635572e5d82c12ef
SHA512

141292c7fccb8d264076adb21f86ba461e49fad0911b7d4ca2d34e9a06bb3cbb75f23fc94dcf8fa189af66ffcbeb6bd18720d08c030a9644ff3150731d48494d
SSDEEP

3072:ZQW4POxNHyDWhb/EDS8Rw9RWD3VmvBmnUWv+Bp9KRb4s1:ZQxPOx8DWhb6Siw90LVmvB1Pu71

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68891a6b8224e410c8128300104aef76_JaffaCakes118

Files

68891a6b8224e410c8128300104aef76_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6f7bae63eebb0fb074f94659c7e654b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GetModuleHandleA
FlushInstructionCache
VirtualProtect
GetTickCount
GetLastError
GetProcAddress
LoadLibraryA
Sleep
LocalAlloc
LocalFree
VirtualProtect

user32

wsprintfA

Sections

(*>re[t(
Size: - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

`arvnw7s
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

'dTlv6VN
Size: - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

V\9]<W=:
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

[6^pkQ$
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE