2ec9ca2ff5b1af1b539681b39efcf838_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ec9ca2ff5b1af1b539681b39efcf838_JaffaCakes118
Size

40KB
MD5

2ec9ca2ff5b1af1b539681b39efcf838
SHA1

12df2530f02b9e712a5f7bb345384e3961acfd4e
SHA256

09ba86f01a5e2d1840e286c5bf83b635b3a18011d46ab6bf694881ea49faa251
SHA512

9fbfcdb22c0d997ec77752ab32c5b48b912809ce605a7792883dc4912c54000f98b18dc6a56f5289f2176513d914a5eb424cf0cd784b9c483d7ac9f800eea530
SSDEEP

768:YbCpswxpP6ZgN7x5i6ojjwcMD8tMZYbfDvMf1pd:xXxpCZ0Mjj1MivMf1p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ec9ca2ff5b1af1b539681b39efcf838_JaffaCakes118

Files

2ec9ca2ff5b1af1b539681b39efcf838_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f26f4d949cfa87e09dcd4e3f296ba6d2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

ExitProcess
VirtualAlloc
VirtualProtect
LoadLibraryA
GetProcAddress

shlwapi

ColorAdjustLuma

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 262B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ