b439d7074b3fa44be41883bcdb3b797e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b439d7074b3fa44be41883bcdb3b797e_JaffaCakes118
Size

341KB
MD5

b439d7074b3fa44be41883bcdb3b797e
SHA1

fdc4429074eecbeaa4c616f8c94400067292ed3d
SHA256

b08b00408494783c159d35926ae25f9b141237e8518c42207d35f661de7b55c3
SHA512

78283e44fee05e1586f013504f41df60e2c035617cdf03af27fa168065368adcab55887c046bcfda5c92279478954eaf8ee98fb84dbaca9d9ece22de33c102a1
SSDEEP

6144:Jjmqh1qvN4+wHlKfRYHZMDqzBC7/t63kiSGRFfkQ8:1hMN4tuq22U7l5vGnfkd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b439d7074b3fa44be41883bcdb3b797e_JaffaCakes118

Files

b439d7074b3fa44be41883bcdb3b797e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

46b0675c1fd7681c7b19a1c83d5aff83

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 300KB - Virtual size: 840KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.asprsc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

san
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE