e49eab0920e305dc0ed7f28eb8dcdb33_JaffaCakes118 | Triage

Sharing

General

Target

e49eab0920e305dc0ed7f28eb8dcdb33_JaffaCakes118
Size

438KB
MD5

e49eab0920e305dc0ed7f28eb8dcdb33
SHA1

b66462876c541674d8f9a8c68c3da6ab131f6473
SHA256

cde75a3200f09e5b326f7d66d58c4ea0f8cc735dd56e011aa16d5a25df244292
SHA512

bcae089a6e71386414a7b50811c3f1490dc957f95435e7445654dfe88a33f877513aee40d62442c019bd04653dd85489f8eb2abb8c2a9c3d18cf6e8783103c31
SSDEEP

6144:K8aiq19Kxjub6YEwfFkeApwGSff+bqdbWYmmCBmVCt53YzSZe27ziio6/Mc0FJ:K8an19KVf0fFbAp63EYmXg2Xiio6wFJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e49eab0920e305dc0ed7f28eb8dcdb33_JaffaCakes118

Files

e49eab0920e305dc0ed7f28eb8dcdb33_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dae2264e721d7c66f7fa35e864d11aba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA

Sections

code
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

code
Size: 431KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ