306b9ca42cde202559aeff2c443e774f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

306b9ca42cde202559aeff2c443e774f_JaffaCakes118
Size

330KB
MD5

306b9ca42cde202559aeff2c443e774f
SHA1

310a83df92f34672fbff0fc9fc02f7894a88a773
SHA256

df162e3b969dc9ff3bb6f96629611c1a0194e5e99b1e47117c30ea5ffe3fdb68
SHA512

44de36f615099e280460f705a030b281d43b25e9248d68ba1cb2bc0061d3aba85941f1afd50d21d5757ddf610fc50f65401a837ee5458cca6415189c39ac5d1b
SSDEEP

6144:+bni9dOTvys2ge1D7UFpovHT9WVA5SqkL8kmOv4Eb4GCuno+DUG7x/9:JdsvyKe1UFGvwq4tmt+hCq7xl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
306b9ca42cde202559aeff2c443e774f_JaffaCakes118

Files

306b9ca42cde202559aeff2c443e774f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Sections

.data
Size: 320KB - Virtual size: 668KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rsc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ