a6bd3026ebff43e660f9276d20363b41_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a6bd3026ebff43e660f9276d20363b41_JaffaCakes118
Size

279KB
MD5

a6bd3026ebff43e660f9276d20363b41
SHA1

bb5b3b130655ed1b6a2af9f83bab2347db7519fc
SHA256

a71395e81b005963664c309459fac5961292c1222d5562bbd40a88036f58d214
SHA512

d830bd159c0c707dcc0f8c59d2c26f1aed34e634bafd51a794ce4d5f979b25d07f4f4ae592e0bf28cc255c0cda231fb9b5fd0faf36349280ee4b82742d520260
SSDEEP

6144:KjgoC7Q2N2hjFUAqOVjqXcFheGN2ZV1+uAdgVAVzrlnVHlHYYI:KsokN2zoUj7HcVQgVAxrryY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a6bd3026ebff43e660f9276d20363b41_JaffaCakes118

Files

a6bd3026ebff43e660f9276d20363b41_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 264KB - Virtual size: 800KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.avc
Size: 512B - Virtual size: 349B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE