398d78be2f416160c49e3907ccbd3f37_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

398d78be2f416160c49e3907ccbd3f37_JaffaCakes118
Size

452KB
MD5

398d78be2f416160c49e3907ccbd3f37
SHA1

95f1c687388d983dda5ebc10e3cd4d48377aefe5
SHA256

e7767ea71d49194cd3df0cb6fbd2ce46eeb413a52652f88ca3ba585c1205240d
SHA512

72dea92fa9ae2cbc6137cab67aaeb3cc3dbf6d1de5e64fca44ef38e8e59444f292c1b78e2dc7760d96ceb423bab99a4491a23489854fcaf84ad1bbd084385c12
SSDEEP

12288:ZMWQ1sHUcv9a15SGyZElKa4eovC/Kcf7afhmtYuYpMBQ:dQ1sHVASOljovC/Kg7afhyY5pN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
398d78be2f416160c49e3907ccbd3f37_JaffaCakes118

Files

398d78be2f416160c49e3907ccbd3f37_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dae2264e721d7c66f7fa35e864d11aba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA

Sections

.Kaos2
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Kaos12
Size: 441KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ