02ff91e13369632e6494ea08414277e8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

02ff91e13369632e6494ea08414277e8_JaffaCakes118
Size

352KB
MD5

02ff91e13369632e6494ea08414277e8
SHA1

0a26c33c6b10c3f859bda415f0a8f085dd8532c8
SHA256

e5c1509dda6b14f23382cf16ef789544c08c479d3df97d4b1fe08b66a86002fb
SHA512

aeeaefe1a5d3af8c7fea30b4e1319989ab523611fc781edcafcf34ac76cfe85b634f606a4e64d51f5398f30e695b84203c7bbf2cda834f40198098a24bc59aec
SSDEEP

6144:MSQPcyGuUBYHX8DPfewkwiH7dR/aJEsB4EbSC75mRcdHVDDkwWrm4ll0H6j2luGx:uPBGuUywHHibdR/O42SCmOBowWrm4obf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02ff91e13369632e6494ea08414277e8_JaffaCakes118

Files

02ff91e13369632e6494ea08414277e8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

acd9fa3a74cc4c1d92998e6ad62eeb8f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
LoadLibraryA

user32

wsprintfA
MessageBoxA

Sections

.data
Size: - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 311KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 509B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE