e0329175d04aa5634351524e66ba6d27_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e0329175d04aa5634351524e66ba6d27_JaffaCakes118
Size

331KB
MD5

e0329175d04aa5634351524e66ba6d27
SHA1

0e98e33d11c3437cc4f8b2254fd28bcf55d37027
SHA256

6ef0cb2691383870755091b64039d94132c9673e16d7e899c69460fd13a56fd7
SHA512

046d09995a85c1d2ed8af5eb300daa5872462a3b2c04208f356b72092cce2a9d60faa190d643621d9da0ff6beff560a13b41d422937f5b00050b95eef2419961
SSDEEP

6144:zFfvQ9ujhQqO3WIgFOZDO7qi4RP3+LNwGi4RP3+LNw:zFfv1Qp3oFOZi7qi4Juhi4Ju

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0329175d04aa5634351524e66ba6d27_JaffaCakes118

Files

e0329175d04aa5634351524e66ba6d27_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3d05135032f86cc84003861744e4f532

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
CreateFileW
VirtualAlloc
GetProcAddress
LoadLibraryW
GetModuleHandleA
GetCurrentProcess
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 44KB

.idata
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ