f5a86021545735b3cc1254a9c7d3b8ec_JaffaCakes118 | Triage

Sharing

General

Target

f5a86021545735b3cc1254a9c7d3b8ec_JaffaCakes118
Size

308KB
MD5

f5a86021545735b3cc1254a9c7d3b8ec
SHA1

2ef2b8c50d4c54c24caa3cf16361cfa6e819b597
SHA256

2b4af4fc4e5b38c414732530acb748a9f97d4c34e062694592b4c500958a7124
SHA512

fb0797404e24e7d779689c6ecb31bc33fd8d9fbd06dfea919bbda3febffcfeb97e36082ef61ca0f70dd9179778caecf5af26d87e21762f2f65bfd6350bfca8d9
SSDEEP

6144:OGBe8Ie00SghLPvQjtDovQ27KVssxCqeIaF9mr/7i9jMRWxK:OGxvtTojivQ27K2sxCqejGXL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5a86021545735b3cc1254a9c7d3b8ec_JaffaCakes118

Files

f5a86021545735b3cc1254a9c7d3b8ec_JaffaCakes118
.dll windows:4 windows x86 arch:x86

81e270ef24435feaef92bcbd1097600c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFree
ExitProcess
LoadLibraryA
VirtualAlloc
VirtualProtect
GetProcAddress

user32

BeginDeferWindowPos
GetCursorPos

gdi32

LineTo
CreateCompatibleDC

Sections

.text
Size: 231KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ