9749544133d2f7f8564b6ac91620428d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9749544133d2f7f8564b6ac91620428d_JaffaCakes118
Size

1.0MB
MD5

9749544133d2f7f8564b6ac91620428d
SHA1

1bcdcd824a1a647a8ddd279181a162976577bfdd
SHA256

1c899af36a0af592a64e1ac44dc0123f710e54470c9ea073d4d0b4e45382a853
SHA512

5bf955cc1e451c3840ba14917f896cdff366b2f4630315e278ba2cae5ccd0ef85d912eb10f29600cae70889e6ed4c8b8112583ac9aa0933107fe9390db319add
SSDEEP

24576:t2xiFMePEiqz34+9eO3UQRGBgMwZvdu7VkIsO8Ge9Mrfq8C1JYFwK:tPEigUODRG7wZvdYkejZ3CjYFwK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9749544133d2f7f8564b6ac91620428d_JaffaCakes118

Files

9749544133d2f7f8564b6ac91620428d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c0ca8fb524d53a294a75f3adfde9e816

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
ExitProcess
GetModuleFileNameA

user32

MessageBoxA

Sections

NiTROGEN
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

NiTROGEN
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

NiTROGEN
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

NiTROGEN
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ