ef5687e4c5c6e9870f482ac17a1aa7d4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef5687e4c5c6e9870f482ac17a1aa7d4_JaffaCakes118
Size

412KB
MD5

ef5687e4c5c6e9870f482ac17a1aa7d4
SHA1

b4968a7abcbd6052b99edc40fd0427cca466807a
SHA256

9ca046ac993e715c9cda1fe78fdda231cada9ede5e6a1b839f44d546499f9ef5
SHA512

eb923dc727dbf28b25a83e6ffa11810dfbbd90d3bf604482eed7879f4e6c11e899b4aa1b4d6df52ddd15f57c03b2549d4b4576d0cc2c4be4406bf6be8ed8a88b
SSDEEP

12288:KFvZy2b0N533rbXJHxHHD20CPSKHRlp/PIz5qR9:qy2b0N53bbXH6tPHRlRPIcR9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef5687e4c5c6e9870f482ac17a1aa7d4_JaffaCakes118

Files

ef5687e4c5c6e9870f482ac17a1aa7d4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3d05135032f86cc84003861744e4f532

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
CreateFileW
VirtualAlloc
GetProcAddress
LoadLibraryW
GetModuleHandleA
GetCurrentProcess
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 72KB

.idata
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ