e1bfac5397270f01aa40ac2659550cf3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1bfac5397270f01aa40ac2659550cf3_JaffaCakes118
Size

111KB
MD5

e1bfac5397270f01aa40ac2659550cf3
SHA1

c58f69858ee0d91ddee7dae53911712446648c7b
SHA256

d1b500182b43101d61d771dda3edbfbb6ed9d5eb6f6bfbf38640fdea6081a44b
SHA512

3a7513e75ae63a747aec556257dd6015817aa73e04ae739685c9ca85d6ea824d0d8f3d3807314c4af7aeed7fa657f047cd624d3ea075021b9dca758da6630fc0
SSDEEP

1536:pV0PEgiByHxfSu9iUM1CRtExuZhCQ8CIrHHGUDdtsP2tdhqKzQ0E6zdpYnSHjVRq:zhgledM5MHd9tmKzFBBN7e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1bfac5397270f01aa40ac2659550cf3_JaffaCakes118

Files

e1bfac5397270f01aa40ac2659550cf3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

04cd30911ab8fb3514e9db248959d6e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
VirtualAlloc
ExitProcess
LoadLibraryA

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 342B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ