067fed2bb9a34ee7476af3ccd5e9c690_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

067fed2bb9a34ee7476af3ccd5e9c690_JaffaCakes118
Size

209KB
MD5

067fed2bb9a34ee7476af3ccd5e9c690
SHA1

4bcd9fae3423183875239fff3f92b2d5af5647be
SHA256

e00b5d68f527a6bbe69f1a3a23c04b299d56b6017283fa0f7e35a5af8864956d
SHA512

a1ba9834d5aaa52b4262c3f0387f45ea61b0c3d0cf1cc70cbfb6f22b20d8457af6f835ac4cd3e65f328205c07f1a192ec517b5d304da95a1d177f40c6736e7c8
SSDEEP

6144:GUvOB50JayC5lKQ7kVZXVoskT0/W+iKHs:GUvOn7Q2UZHW+iis

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
067fed2bb9a34ee7476af3ccd5e9c690_JaffaCakes118

Files

067fed2bb9a34ee7476af3ccd5e9c690_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3d05135032f86cc84003861744e4f532

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
CreateFileW
VirtualAlloc
GetProcAddress
LoadLibraryW
GetModuleHandleA
GetCurrentProcess
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 88KB

.idata
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ