95b703f8d8881020f812599ca71a5e24_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95b703f8d8881020f812599ca71a5e24_JaffaCakes118
Size

106KB
MD5

95b703f8d8881020f812599ca71a5e24
SHA1

c80ed69dea094760efaaa65fbd9ec654af869092
SHA256

4b93c1299aa31a152fbcdb4c85980fc2a3e5f1d03db1994616196bb61df39411
SHA512

16b13768a44e3ec0f3df62207bb1024f128c83488d45205339484a3a6a9926fe80190f8acfe8b6ae201cbc7f8fb78aec42c15b1606c450f0cd777f6cdaf64d46
SSDEEP

3072:qpR0AMwfX3Btt5kxa/FTntJVAK4mI6YB6u+zxH:o0+H1ueZJVr4mI3B6u+dH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95b703f8d8881020f812599ca71a5e24_JaffaCakes118

Files

95b703f8d8881020f812599ca71a5e24_JaffaCakes118
.exe windows:4 windows x86 arch:x86

003e9a1599dd718a7a215c4a089b011e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
LocalFree
GetProcAddress
ExitProcess
LoadLibraryA
VirtualFree
VirtualAlloc
VirtualProtect
GetModuleFileNameA
GetModuleHandleA

user32

MessageBoxA
wsprintfA

Sections

.text
Size: 71KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 588KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.epld
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eplid
Size: 566B - Virtual size: 841B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.epldat
Size: 512B - Virtual size: 486B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eplrl
Size: 440B - Virtual size: 645B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ