29b309e4538b0def946f768cc011c977_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29b309e4538b0def946f768cc011c977_JaffaCakes118
Size

295KB
MD5

29b309e4538b0def946f768cc011c977
SHA1

592979c6a5a1300c36fd54ce6955eccbdb4e8940
SHA256

dd001da1a57ccdaf1c5737bde0e72d2eb1f23c3526e2aa969b52ed7a59638ba3
SHA512

82f1f368f895bf3a4633497fd12d6fc246ae4c9e9de4d6d5513f12a6922295ddf500b3b633d018195a37badb06d72fd902217184aa5a94af3d4f97d366468aa1
SSDEEP

6144:hBa8+pkLA5sP+ye/GZW+WYoUIxvHHo3pVxN11zNmr8l0:hQGPmeFsFI5jEy0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29b309e4538b0def946f768cc011c977_JaffaCakes118

Files

29b309e4538b0def946f768cc011c977_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c0ca8fb524d53a294a75f3adfde9e816

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
ExitProcess
GetModuleFileNameA

user32

MessageBoxA

Sections

.data
Size: - Virtual size: 788KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 257KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ