ed91324f0907b0f4b545b7520ab8e469_JaffaCakes118 | Triage

Sharing

General

Target

ed91324f0907b0f4b545b7520ab8e469_JaffaCakes118
Size

1012KB
MD5

ed91324f0907b0f4b545b7520ab8e469
SHA1

c473dfe2f0d04e65ef0a90c52b65d74a57991236
SHA256

79ff73ebfde3c274add059b985205481e2a77cf5f04163ca3a42682b52bc44df
SHA512

ba29fe6e5f12b5e084e6eb5cd715a8713ded394fd29641266124368ac7c782c376cf7c15ea46ef3453808fd792218981fdc7bc41af2e29bcc5c6f4cf5123d806
SSDEEP

24576:I3YWhPxKAxGuAHSM1C7jYf96EAHZKF4n7S2NTtBT/:21hHgukSxjsA5KFUttBT/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed91324f0907b0f4b545b7520ab8e469_JaffaCakes118

Files

ed91324f0907b0f4b545b7520ab8e469_JaffaCakes118
.exe windows:4 windows x86 arch:x86

102b07e81a29f97ab5b1b73838ecb914

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysAllocString
DllUnregisterServer

kernel32

GetModuleHandleA
GetStartupInfoA
GetCurrentProcess
MultiByteToWideChar
InterlockedIncrement
ExitProcess
TerminateProcess

Sections

.text
Size: 840KB - Virtual size: 839KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.version
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ