050cd52ca89662c9f595f8cba492dbca_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

050cd52ca89662c9f595f8cba492dbca_JaffaCakes118
Size

711KB
MD5

050cd52ca89662c9f595f8cba492dbca
SHA1

fc63435d3ccd7e931c176510e6d7aadc8e340b46
SHA256

b954d8f13cb11c54595aea11bfa5c7611ab6d29fdf63f7f362a8a6af48701b40
SHA512

f0099f98f921050aa35eb556a5824e658ace98fc9146e8b56720e22f68dcf4a03b76907fb38b1397191895184486c94c24c38478a97a71f3e973e0bafe64d5a5
SSDEEP

12288:QrCx2W2Q6Y2BVQ428W+vqWt0S9SiPYZZz1SHU1vOjYt/8DIhd0rA:Rx2WeBVl2b+vhOUpkpSHU1r/eIhdL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
050cd52ca89662c9f595f8cba492dbca_JaffaCakes118

Files

050cd52ca89662c9f595f8cba492dbca_JaffaCakes118
.exe windows:5 windows x86 arch:x86

53e92335e74fd01f0d86758a87341ec2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteW

iphlpapi

GetAdaptersInfo

ws2_32

gethostbyaddr

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 64KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 585KB - Virtual size: 585KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sfekeir
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE