ebbd0d95f78cda1e5b8ada5434f0816c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ebbd0d95f78cda1e5b8ada5434f0816c_JaffaCakes118
Size

43KB
MD5

ebbd0d95f78cda1e5b8ada5434f0816c
SHA1

e02cb795066908908e6f6dec5de341cc8c73a91c
SHA256

60080615fc966cf8a2efe568093019bfc308feb925295d71ca77a95f422ef9eb
SHA512

15356fff60bcce83c0cd202d2320be1229a400eedcbe3bd3eaf6b266e872a81249e8db441f86bdb495b2361e204dd8d533bf8f8eec20094d8b1ea9b626182ab3
SSDEEP

768:+Vvbig+GhnioQcPhI4Py3iyx/UgUC3G6lPPsF9T+AUM6PgC4zcryMM+NaVV+Yb8Q:6HhdP+5AjC3GcPSSAUMiy3YuV+Yb4djM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebbd0d95f78cda1e5b8ada5434f0816c_JaffaCakes118

Files

ebbd0d95f78cda1e5b8ada5434f0816c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

db3b2cd368e42ed217b545ab175dd884

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleA
GetProcAddress
LoadLibraryA
Sleep
VirtualAlloc

Sections

.text
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 256B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256B - Virtual size: 51B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hehe
Size: 40KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE