874c30cd7c9438a8f00fc07643df7e9d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

874c30cd7c9438a8f00fc07643df7e9d_JaffaCakes118
Size

259KB
MD5

874c30cd7c9438a8f00fc07643df7e9d
SHA1

54ef6697d5aaae6cc2628559ba5773785ce6454a
SHA256

635c5b0f05228cbe863d54aa3e32ceb1143ba74654cd90ece3accd1b7c8bf7b2
SHA512

5ee4f8fdbd979f6ec3373a3f53959abdcc831f39e5683b1f21636a02872806ef905d4c0dcac80ee922912228601a26d1eababf2120131e9754c4e41f05ed386d
SSDEEP

6144:O+T0+iehQnxFnVG03u4Ep8MbRZR8QLV4LpQM2ChGspUtbXl:iyIFnE03uFfR8QBnq0scp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
874c30cd7c9438a8f00fc07643df7e9d_JaffaCakes118

Files

874c30cd7c9438a8f00fc07643df7e9d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 221KB - Virtual size: 584KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ddd
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE