8b50f485232d193db50057803ea8ed3d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8b50f485232d193db50057803ea8ed3d_JaffaCakes118
Size

1.5MB
MD5

8b50f485232d193db50057803ea8ed3d
SHA1

3fa93fc364b18872d3d8b812e77d9ebe9c58a210
SHA256

d926de46aac0d92489d49961d9412abdfc7c60df55ae06ee598879d8746e4075
SHA512

63bbb7d8daebdbba18a49c23a99471990885ebb246ea4e6996f739027b3a24c540ebece5be477bd0a012d865ee66fbdf394cd442967fe378ceb06b87e012d7c9
SSDEEP

24576:5JX7R9zeCaUVtfBJ+hSiqNiQAOTFg3K55ounbsjad0DsrNfcNx2fK:TXF9zfRtZJ+giqNiQAOTsSAaZcNx5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b50f485232d193db50057803ea8ed3d_JaffaCakes118

Files

8b50f485232d193db50057803ea8ed3d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 1.4MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE