b35b7b48e62df92cdcfeb5c0f2026431_JaffaCakes118 | Triage

Sharing

General

Target

b35b7b48e62df92cdcfeb5c0f2026431_JaffaCakes118
Size

207KB
MD5

b35b7b48e62df92cdcfeb5c0f2026431
SHA1

4d343aecbf8e95ead13c6941f684eccf0ff5212b
SHA256

0114f17b16769b0155d92663698bb02482b4991ebce80ee3aa40ed395971c1a2
SHA512

14f8bde0c4e2a834ce62b4b9118f74bafdbf9ab44f975cce5f4706f3e9a790bb54403731e3c4e87221190a7944e12c114cf63c22763fc52bae34df2603b2f39b
SSDEEP

6144:nA/G0OX50sIbo8zBeEjdrxAruVv4ogyOICq4G2:nAu0TbPjdriSVQoSICq4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b35b7b48e62df92cdcfeb5c0f2026431_JaffaCakes118

Files

b35b7b48e62df92cdcfeb5c0f2026431_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c0ca8fb524d53a294a75f3adfde9e816

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
ExitProcess
GetModuleFileNameA

user32

MessageBoxA

Sections

.data
Size: - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 288B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ