cf667cf75ab2655d032fc3b422971e73_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf667cf75ab2655d032fc3b422971e73_JaffaCakes118
Size

227KB
MD5

cf667cf75ab2655d032fc3b422971e73
SHA1

3fd4f973e9e5b7cd91b5ba33c70f79813139c023
SHA256

c0fa60cb186c92d315a910faa7372d3e90e7eaecbf8d0bf9db14f872d1703ad2
SHA512

af7672e259137a29c97dd9a5aaebb412edd9513bdd4b2fe6286f5de4302e92e7ef6f3f4a4a71305067ae1f119827d8bbef07692e4257b95106baaa285aeca263
SSDEEP

6144:U4lwZ40243s0gJvyTZaPYZeHF/tIzi+Tk98i9goc8VRtDkYl:7n0d8PJvyQYZelVIziveo/RtR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf667cf75ab2655d032fc3b422971e73_JaffaCakes118

Files

cf667cf75ab2655d032fc3b422971e73_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8ffc31bccd11f7f873be952d93bdc291

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

advapi32

RegOpenKeyExW

oleaut32

SysAllocStringLen

mscoree

CorBindToRuntimeEx

Sections

.text
Size: 214KB - Virtual size: 540KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE