b1ade28d41b48794bfa70d138e6a0dc3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b1ade28d41b48794bfa70d138e6a0dc3_JaffaCakes118
Size

24KB
MD5

b1ade28d41b48794bfa70d138e6a0dc3
SHA1

9bcbf684bc9bff13068570229be51a191319598a
SHA256

b3cec98696c810280afe58c149668a806732248b158404c01f9630077de8a448
SHA512

9da5e9292aa28766ee64e40ae9f42b09a8cdfbbeab74ea593c7aec8392cfe5f7fc53daff0657185ad506658c6b0fab7194b67a78e34c0c939c891d9d2b7f525e
SSDEEP

768:at7LL++mXpIrUnc5ruJAQ5gYCUNNx+6FnU5:a1LLrYIoI+A8gYCUc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1ade28d41b48794bfa70d138e6a0dc3_JaffaCakes118

Files

b1ade28d41b48794bfa70d138e6a0dc3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

63eeea7699532f48bdec730fa1a78c59

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapDestroy
HeapFree
HeapCreate
HeapAlloc
GetProcessHeap
ExitProcess
VirtualAlloc
VirtualProtect
VirtualFree
GetProcAddress
HeapReAlloc
LoadLibraryA
IsBadReadPtr
lstrcmpiA
FreeLibrary
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 582B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ