88f970581210e26bd86459870c09d899_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

88f970581210e26bd86459870c09d899_JaffaCakes118
Size

172KB
MD5

88f970581210e26bd86459870c09d899
SHA1

3af64501865d425ac5ee831053eb4fe1e28e9f6d
SHA256

08e7df36fd125d42add44aa205d295607513edd3b3bd2cca7c36c2ab0ab1f6f7
SHA512

b1d10e8f172565d3745c492e6eeb8a73dd2647c097ad2720f866a3cf155e018c2948f691438ba0540254309dd7047be764c01ee32a2d9291f5f0533459855f5a
SSDEEP

3072:Cc4WnEnyLFFYNwW71gFE2QpJxRCcCx+lZgX59o7od16F:IWEqFQw8QE2QpGxUZ65oH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88f970581210e26bd86459870c09d899_JaffaCakes118

Files

88f970581210e26bd86459870c09d899_JaffaCakes118
.exe windows:4 windows x86 arch:x86

22aa25a9dbb99211db866b1a30897dd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GetModuleHandleA
GetFileSize
FlushInstructionCache
GetTickCount
VirtualProtect
GetLastError
GetProcAddress
LocalFree
LoadLibraryA
Sleep
LocalAlloc
ReadFile
VirtualProtect

user32

wsprintfA
wvsprintfA

Sections

]qXc<?5F
Size: - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fYvykfq2
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

dZRg`!ro
Size: - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_!H!y+r
Size: - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Pp jUv^$
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE