786f7e6437a84e9c2d10390bd60a8029_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

786f7e6437a84e9c2d10390bd60a8029_JaffaCakes118
Size

79KB
MD5

786f7e6437a84e9c2d10390bd60a8029
SHA1

2494f97ac9e946860074c6fbd06c0a273d743405
SHA256

0355c04a93259be7471806f88a92271256891a0c386e3f2796a8b3e66992512a
SHA512

95f5b49866a63fb9959ccb5ec6a5e4cb84e13c787ad648885cef598f72cf062948988871d1d6bdccdc2f28bb6344470b6c70ddb8d95cf1cb62e3aaa5f7e46688
SSDEEP

1536:Lj3YAAYvTWe3pVIKu4t9SRBp8K5hS85NfEcDMlNu3gKIhB9vJtbg:XYAAYvTWeZjDUHSybcu30h7bg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
786f7e6437a84e9c2d10390bd60a8029_JaffaCakes118

Files

786f7e6437a84e9c2d10390bd60a8029_JaffaCakes118
.exe windows:4 windows x86 arch:x86

809dc1cf087e33f00ad510211c4011bb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32Next
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

advapi32

GetUserNameA

msvcrt

_exit

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 878B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.v[]0
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.v[]1
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ