2a1ea0ae69692f2125be662847a59509_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2a1ea0ae69692f2125be662847a59509_JaffaCakes118
Size

262KB
MD5

2a1ea0ae69692f2125be662847a59509
SHA1

83779eef0e788abab56450537ca0a53db9f0b456
SHA256

f28ad8ddfd0ec6dcf8c389f49b1199b91056a90a751d2aac93eb9ca04d3892f8
SHA512

3db9dd8cf696ff3abbae94868e6299a5582535a25ae713033c0d7e3a26710ff0bf5b2edabb997c04a032411dc2c50379ed480cd2278329a9e5126677822648c8
SSDEEP

6144:d5mts+yZ2zxvsr6Jj8fjvA7sG8jaBkj2p0JwaNnRSChs8bEOsgX88xAlr:dE6Z2zx0wj8fjvWN8+30Jw2RMIJQr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a1ea0ae69692f2125be662847a59509_JaffaCakes118

Files

2a1ea0ae69692f2125be662847a59509_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6c775b6573a9f92d88775e1d059aeb7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAddExtensionA
StrFormatByteSize64A

kernel32

GetProcAddress
LoadLibraryA
VirtualAlloc
ExitProcess
VirtualProtect

user32

GetMessageW

Sections

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ