16eeaa62aa06891801b42955cbf65d6e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16eeaa62aa06891801b42955cbf65d6e_JaffaCakes118
Size

1019KB
MD5

16eeaa62aa06891801b42955cbf65d6e
SHA1

0bd18a9cf7a18e6dd0d283dca9d43a304af895e4
SHA256

8dafb1d5358ebbf64c88a89d5c339f386444ec7fb1183431fa07ac5b6fff4ef5
SHA512

75ae2275676e7c417452ebd016b3b7e5dffe3134991ecb39e457fec1ac2745f19e485fdc97e9765e0e184a9c95e37ec46b2a13e44bc3dbbc899262e2d55e7072
SSDEEP

24576:sk/ReXS3gH3jxMroo+kBErb3mla7iiBUcdftVEZHnaho:fReC3gHzxMsjPmZmnVE5naho

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16eeaa62aa06891801b42955cbf65d6e_JaffaCakes118

Files

16eeaa62aa06891801b42955cbf65d6e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9532ff2f2b6b41b35b68fbc8f4148143

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

ExitProcess
EnumResourceNamesW
GetCurrentProcess
GetModuleHandleW
GetCurrentThread
VirtualFree
GetProcessHeap
Sleep
TerminateProcess
VirtualAlloc
IsWow64Process
GetCurrentThreadId
GetCurrentProcessId

user32

MessageBoxA
GetGuiResources

Sections

.text
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ