ab609c6d0f792a1c9c0cd8ca527f14ae_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab609c6d0f792a1c9c0cd8ca527f14ae_JaffaCakes118
Size

138KB
MD5

ab609c6d0f792a1c9c0cd8ca527f14ae
SHA1

4d3adc2c1df50dae11fe01891dbc7bf812a42928
SHA256

bf12f058a762a8e1a85abc117a8904369363d10bb60094c8d26f4359903c67fd
SHA512

d180bbb87804a28f3355aa82efc78125a1e8b83d26570699beeed9e49ef53a4229316ac3f8e3fb4e4d106301f77cf5bb1347f3e28754d40057e301f991b03dcb
SSDEEP

3072:vsHuQMSSb/FxsCDk9Ys2IUT5ME0i4oYw+dgffXb4iujGdzWMp8:EO76Ce6IogiHBv3ld6Mp8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab609c6d0f792a1c9c0cd8ca527f14ae_JaffaCakes118

Files

ab609c6d0f792a1c9c0cd8ca527f14ae_JaffaCakes118
.exe windows:4 windows x86 arch:x86

26f9ea1bcc566bdd8da35e86b79fffaf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetCurrentThreadId
VirtualProtect
LockResource
LoadResource
FindResourceA
LocalFree
VirtualAllocEx
GetCurrentProcess
ExitProcess
GetModuleHandleA
LocalAlloc

ole32

CoInitialize
CoCreateInstance

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ