ff573c3ce26840fdc0282a6234a29764_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff573c3ce26840fdc0282a6234a29764_JaffaCakes118
Size

141KB
MD5

ff573c3ce26840fdc0282a6234a29764
SHA1

dae6046231b3487140b495771c3ac9aeaf9954c0
SHA256

2cfeafd375bf681a71a00045a9017c02eb3429d06591e51d87d6eda5f9aa7210
SHA512

91522c2f7a65b2c075a6f6611c57f90e3371541e833b15fec6b0422d45a280399b30a1aa9fb54be5af7ce27a81d7abec96f21f497360b5a3b01215e8e55ffcc2
SSDEEP

3072:Quy+vJhfm0p1WX0JJC4a9X0oaZzEUx8JUNdUqARmMulFUz6G:nhfmk1I0JJC45MUx8JIpAsMulFI6G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff573c3ce26840fdc0282a6234a29764_JaffaCakes118

Files

ff573c3ce26840fdc0282a6234a29764_JaffaCakes118
.exe windows:4 windows x86 arch:x86

99fc69d43b9cd9fe874a0947318e4eef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetProcAddress
LoadLibraryA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rawdat
Size: 126KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE