b319e141bd4ac4cee08a408aced9edd0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b319e141bd4ac4cee08a408aced9edd0_JaffaCakes118
Size

151KB
MD5

b319e141bd4ac4cee08a408aced9edd0
SHA1

69e65595d2973210e1fe47fb28e3ef10d096292c
SHA256

2340ee44273d0b1416ba723a0d2137e7ff113b934f691078894a99925d35eab3
SHA512

9cb18065f5c517adecf36b254afa17f6ac510968d7c151f7c6677450b02ed9bbe4f87896dfa5160859e28c6cf0e27360bd0feb737d60d1ac91caccf9edd5025a
SSDEEP

3072:36kywnDA5512w+qA9P9YzAn/EGVRlXZO3s+CQv:3Tu1v5AJmzcPDZGQQv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b319e141bd4ac4cee08a408aced9edd0_JaffaCakes118

Files

b319e141bd4ac4cee08a408aced9edd0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6fdfa6fdf45b6363bf8aeb10a681cfab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindCloseChangeNotification
LoadLibraryA
VirtualProtect
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

user32

DefFrameProcW
MessageBoxA

gdi32

CreatePenIndirect

msvcrt

_controlfp

Sections

.text
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc0
Size: - Virtual size: 602B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc1
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc2
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE