838ddedc50c2741077828c90315a6f4d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

838ddedc50c2741077828c90315a6f4d_JaffaCakes118
Size

40KB
MD5

838ddedc50c2741077828c90315a6f4d
SHA1

bdc11614eab134a338d25f07765408fed7832785
SHA256

7d6b437c465ffdefbb46de822af6986f73bf45f9fc0063130d76463ff2c8f34b
SHA512

2425746d2782dcd5c003078078e0170dca42d1c7b744013bbcef5be73f2af3227f0056610f9eada8792be05996abb6a538384268fc276c49bd0e82e50d73e927
SSDEEP

768:z6VGfhdbEtVI3L8C5xzk9d6NiXxybUqc3os+2uCuJnX6aicCeDQ:GVGfhdbEtVI782zk9IDUqKuZdTDQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
838ddedc50c2741077828c90315a6f4d_JaffaCakes118

Files

838ddedc50c2741077828c90315a6f4d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

15a40fc888a24c3586ca9563306e006f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
ExitProcess
GetModuleFileNameA
LoadLibraryA

user32

wsprintfA
MessageBoxA

Sections

.data
Size: - Virtual size: 444KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE