f0b8d8bcbc4840ba802e4b43cf134af5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f0b8d8bcbc4840ba802e4b43cf134af5_JaffaCakes118
Size

171KB
MD5

f0b8d8bcbc4840ba802e4b43cf134af5
SHA1

f9ebead8b7dee3fa8f0823bc22d6fcb376ad41ca
SHA256

f3299cbe6af2ca473d77114739ab563238e243d14982b1d364efcc3e74c422b5
SHA512

a47b48d93e532c88c567896d89181e3800f75ff2c9f54701d2892066339ff14b4ce93b44c499d7eca3503d4deb96ea54e247600fce45341d7281c6a8ff727f61
SSDEEP

3072:jfxKL1cfg5vLbV56FoGyXi/qW6++hLAtfzlPI2vE6IyzR/QTbtZe:jfx41c4BB56ebXPW6TLAtri0Eeybtw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0b8d8bcbc4840ba802e4b43cf134af5_JaffaCakes118

Files

f0b8d8bcbc4840ba802e4b43cf134af5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2e2a8ee168c8415f8e42d78d522fafb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
GetProcAddress
VirtualAlloc
LoadLibraryA

user32

DispatchMessageA
TranslateMessage
GetMessageA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ