fed5183da9510ace23a91a74ceccd45e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fed5183da9510ace23a91a74ceccd45e_JaffaCakes118
Size

363KB
MD5

fed5183da9510ace23a91a74ceccd45e
SHA1

6232963f8630b9033bbae2e7525b6c6035de7b3e
SHA256

9a3acf2338722d32016fd426070bc19ebd67c0efa14e03302e6da894b6a7819e
SHA512

a04212a41be7cc2fe316a950fdebe60ed79d703dea1e2c8215391649b26612132c31c3b5d10f8558b5f6e6e89c3c1d2d1869c59ed5f0077e45c48f397e2c9238
SSDEEP

6144:OtvHThBuOpdzFRhmmu6Dm6opeO3gGy+Bwquq3rJGviv0AbSZ/yqHXrt04zlM5hQB:OtvHtoKzFEZpeOQGsbq7JG6vmZ/XXrW8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fed5183da9510ace23a91a74ceccd45e_JaffaCakes118

Files

fed5183da9510ace23a91a74ceccd45e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 351KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ