3cc41856a7726f92a5b5a4d5ff487d4e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3cc41856a7726f92a5b5a4d5ff487d4e_JaffaCakes118
Size

271KB
MD5

3cc41856a7726f92a5b5a4d5ff487d4e
SHA1

f1d235090659ebe5ff6615f254244c00dab5adf1
SHA256

e425dcf6410039e34689922516319632b9975f73491a172052c2c739a2f47c44
SHA512

f470fea1c1f0be41f9844219f829ecb3361c9a92879c0635cce432c8650676600d28f2a648d840b597a4780d3ca18117d80791fb0190bff9b1aab23b004e9172
SSDEEP

6144:qkAHe2TKRLFC5LjD8ekKtXO1t6j3aNv3Yr7x5WHgW:ZANI4jDHx12t6j3aNgH/SD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cc41856a7726f92a5b5a4d5ff487d4e_JaffaCakes118

Files

3cc41856a7726f92a5b5a4d5ff487d4e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f14949ed9d4fe8d2d7ea56338804a15e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAddExtensionA
StrFormatByteSize64A

kernel32

VirtualAlloc
LoadLibraryA
ExitProcess
VirtualProtect
CloseHandle
GetProcAddress

user32

GetMessageW

Sections

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 265KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ