e1e297304379664836ca86b7ac1c7e49_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1e297304379664836ca86b7ac1c7e49_JaffaCakes118
Size

558KB
MD5

e1e297304379664836ca86b7ac1c7e49
SHA1

db2c9a4cb1cbe24d5dce07c2bef778d9d49126ad
SHA256

4a7c81fc81c053c38a78fbb73c621fbcd59c8088c15d49b2a6fdff32947eca96
SHA512

e2b5af74beefc45a78d58417f109e918681253e7a69e7fdb1caf1741b4b0813c72ec6c415eaae9a898b152abfdfcdd25c29126b2a750cb8cd53d01291625dc5f
SSDEEP

12288:KmfRHH1OmfxeQt/LRTlyE2pjSHgVA49tdUsVD7aXvulAyYFdMF/:NRn1d1TP2puHgVV9t/VHaX2lcMZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1e297304379664836ca86b7ac1c7e49_JaffaCakes118

Files

e1e297304379664836ca86b7ac1c7e49_JaffaCakes118
.exe windows:4 windows x86 arch:x86

acd9fa3a74cc4c1d92998e6ad62eeb8f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
LoadLibraryA

user32

wsprintfA
MessageBoxA

Sections

.data
Size: - Virtual size: 1012KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 517KB - Virtual size: 517KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ