7598fa8e511f62c71f26fe400d59274c_JaffaCakes118 | Triage

Sharing

General

Target

7598fa8e511f62c71f26fe400d59274c_JaffaCakes118
Size

378KB
MD5

7598fa8e511f62c71f26fe400d59274c
SHA1

8c58c0ab83af4433c5fbdd44cca1a9f457393500
SHA256

a1f3517e788cdcd858100b2a9d8150af35ded70680f1ef1035073c16d1b42ad0
SHA512

e3f9f35f281db8bf7bde4fc1f61cc8a0cc8876244ac78c79333459c9c699ad2af4e2da75224ab8100dcceea322ea92a717efa435e03fbffc68fc96dcc5040a88
SSDEEP

6144:hWSbdBjwzR/7LisOhbUwls8fH7SCl9PM75hE71UTU3OmgJwUzRi4GOVHtNYlq22A:hWSbd5SohbUwlsC9k75hE71Ue+Xz04Gh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7598fa8e511f62c71f26fe400d59274c_JaffaCakes118

Files

7598fa8e511f62c71f26fe400d59274c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 368KB - Virtual size: 756KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ