8d0489beb63c5effd7328163bfe4de22_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d0489beb63c5effd7328163bfe4de22_JaffaCakes118
Size

300KB
MD5

8d0489beb63c5effd7328163bfe4de22
SHA1

3a02314a63b532f98ff12e78b1d3e761c9fab352
SHA256

caad33f450b484bb506ce730f64324543b036b874eba656a3f120ba0273f312f
SHA512

fd4596cff038288bec10aefd290920e3988586caa94455af3e6a850d15918e17058d77c5ce5d5858444a0c6da95960ecca595727956a8f5268bc507d92c87fc5
SSDEEP

6144:gv+fxii+dixHjrDtZ8569qcftXGct5AA7iPxJ5D0Rls47YlA:g+Zi8Hv5ZkRcftXXvAOmsqUuA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d0489beb63c5effd7328163bfe4de22_JaffaCakes118

Files

8d0489beb63c5effd7328163bfe4de22_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 256KB - Virtual size: 804KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ