d10bba06249418f9f3c1f9f24bf56e63_JaffaCakes118 | Triage

Sharing

General

Target

d10bba06249418f9f3c1f9f24bf56e63_JaffaCakes118
Size

646KB
MD5

d10bba06249418f9f3c1f9f24bf56e63
SHA1

768b8dd0313e23cbcfbd6b61e2de365dfc49aa32
SHA256

fa37f162d04b8053a2fac5d6d39fabc2908a9a038a10c2739d266a332e32cff8
SHA512

08ddc6a4e0e23e4af93f8faf78d6f134cc62ae93ae0d1cd75212763dd579ce23782fff83f3f1a5afe7823fd20636412c21dba6953c5d366344b91c247beeb45e
SSDEEP

12288:dJERUsIDu4qLQl5dpbVnvzkWVCJx17rtd2SpOxBDzfdtK4dbzvJ70yLYwit:dJ8ULu4qLQLd7nvzZVCJTNhpO7Dbdk4C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d10bba06249418f9f3c1f9f24bf56e63_JaffaCakes118

Files

d10bba06249418f9f3c1f9f24bf56e63_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 633KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ