d180ab0f7a8aac5d9a9d594071a30139_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d180ab0f7a8aac5d9a9d594071a30139_JaffaCakes118
Size

238KB
MD5

d180ab0f7a8aac5d9a9d594071a30139
SHA1

c0b01716f8301432055cef8f02ce41e4dc71e9e9
SHA256

e5371d0bceb6598857e1a06db4c8341f86b87848778176585fc12c7172b3a3db
SHA512

28973f6d1cba2f177eab622a02d675241e2c375d2eded6cf3f6e452c1574d96b721d6118a40f46bfe41be47187c58ee65d8d63536ae7af4cee641dce52303ee5
SSDEEP

6144:y8D6AOgqsLKX24h8a81xSvzOBZ1tvELviPdyDcj6:BrTR4h8aiKzOBfGiFyQG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d180ab0f7a8aac5d9a9d594071a30139_JaffaCakes118

Files

d180ab0f7a8aac5d9a9d594071a30139_JaffaCakes118
.exe windows:4 windows x86 arch:x86

acd9fa3a74cc4c1d92998e6ad62eeb8f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
LoadLibraryA

user32

wsprintfA
MessageBoxA

Sections

.data
Size: - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ