2e6b836829bfcfb9d5ff023e44ff36e7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2e6b836829bfcfb9d5ff023e44ff36e7_JaffaCakes118
Size

43KB
MD5

2e6b836829bfcfb9d5ff023e44ff36e7
SHA1

77f09702a3c925b23fbb896a13b098f600488bc2
SHA256

ee4b9ccce168be37b76be06857cadaff0cb0c51bdccd06c94a85a5726ff4e881
SHA512

5b3270e7c391f2b1eba2d59bff1a0b63b74e5458162996bc812c48f21b2c01620a8896196afa5a32e92b18a25adaea235822008198adb99b4e8ad43c2cf629b4
SSDEEP

768:YM3kru+8rXXOcMi+sXDmjWgtsLh4OV3h5GMu5n9/iVTbU:YM0rELX2rsXDmiTFVi5n9/kTg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e6b836829bfcfb9d5ff023e44ff36e7_JaffaCakes118

Files

2e6b836829bfcfb9d5ff023e44ff36e7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2a7e2418be8a09fc671a0ee84b34f19e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
ExitProcess
lstrcmpiA
VirtualProtect
IsBadReadPtr
GetProcAddress
LoadLibraryA
CreateThread
GetModuleHandleA

user32

MessageBoxA
DefWindowProcA
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
SendMessageA
KillTimer
GetMessageA
DispatchMessageA
TranslateMessage
SetTimer

Exports

Exports

func1
func2
start

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 838B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ