f6f332f8cd6f395c6a618840613e7bdf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6f332f8cd6f395c6a618840613e7bdf_JaffaCakes118
Size

76KB
MD5

f6f332f8cd6f395c6a618840613e7bdf
SHA1

9938aa91fe6ab9eac42f71aadc80dcb5b1949d12
SHA256

747e265827fda63ade24b23f558d643e7e1b539d09881818dc25ce8c61e553a4
SHA512

de079d60aa4d20eb4982b16c8065f28376a16b99b05ed1ba2410b53cbcf1b862a5699ae939a5657816ac2395740238b09f4212dd0709cf66bbe8723afacc123e
SSDEEP

1536:mxHAiVgtYjJe95k8CvVqBURuLRs5V7CNELbJBrYmsAQ:m1Aegtwe48CILRs/+ELlBERAQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6f332f8cd6f395c6a618840613e7bdf_JaffaCakes118

Files

f6f332f8cd6f395c6a618840613e7bdf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c3d6013c1ba6e2adb9a25b438e572184

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
CreateSemaphoreA
LocalAlloc
GetProcAddress
LoadLibraryA
VirtualProtect
ExitProcess
LockResource
LoadResource
FindResourceA
SuspendThread
HeapFree
GetProcessHeap
SetFilePointer
VirtualProtectEx
VirtualAllocEx
GetCurrentProcess
CreateFileA
GetModuleHandleA
HeapAlloc
DeleteFileA
InterlockedExchange
RtlUnwind
VirtualQuery

user32

ShowWindow
GetActiveWindow
CreateDialogParamA

ole32

CoCreateInstance

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ