aa7738d8eff87e13eea0251b135cfb30_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aa7738d8eff87e13eea0251b135cfb30_JaffaCakes118
Size

297KB
MD5

aa7738d8eff87e13eea0251b135cfb30
SHA1

d70fa4d623e1d78e1173f1dfde504dcaa835befe
SHA256

94067ec29697becb236e5202b06a7fc4baa115912160ef09122dea002cc2d0f1
SHA512

ed0851036ae55260d9e1b12c54d5e6f81e73eac137581558856f78e6942a953c014a25b841bab3dc3c1ff77c65e3af7b42b2c34d0f233cf3dce7cb6218ea6a03
SSDEEP

6144:GWW1ZLQUVvg01HpxA2//yQ9FlE6S+Zs39WURXCF:ek2g0ZpmEXHlC+S3YKw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa7738d8eff87e13eea0251b135cfb30_JaffaCakes118

Files

aa7738d8eff87e13eea0251b135cfb30_JaffaCakes118
.exe windows:4 windows x86 arch:x86

acd9fa3a74cc4c1d92998e6ad62eeb8f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
LoadLibraryA

user32

wsprintfA
MessageBoxA

Sections

.CODE
Size: - Virtual size: 784KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DATA
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HackSA
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

MissWe
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Root
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE