f0bb48bb735873f1bfcb7eb15d5812ed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f0bb48bb735873f1bfcb7eb15d5812ed_JaffaCakes118
Size

174KB
MD5

f0bb48bb735873f1bfcb7eb15d5812ed
SHA1

bd400ca8930a56e113336453013b0e38612e699f
SHA256

c36cd948189cb6c9d250e1ba4a7dd1928c8f7e34bc824f02eebf2f094c104b5d
SHA512

494c36d47677f8fdac706a73099a1a3dc76dd2bda19b05954b49caddeb9a96244691d5aa1713d9123cdcc20c5e200e6bbe9346f10126aac2a6c546a2fe11b31e
SSDEEP

3072:EoQK9EcgUs1ruBtSnOMaLX3UbXOI8ekFa6IYEu24gXEzHuVXqQnD+rYG:EoQKqcaaX2baLX3Ub5P6RAUHuVqID+r1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0bb48bb735873f1bfcb7eb15d5812ed_JaffaCakes118

Files

f0bb48bb735873f1bfcb7eb15d5812ed_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3d05135032f86cc84003861744e4f532

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
CreateFileW
VirtualAlloc
GetProcAddress
LoadLibraryW
GetModuleHandleA
GetCurrentProcess
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 8KB

.idata
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ