f496c89aa5334459778a8f953be88b27_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f496c89aa5334459778a8f953be88b27_JaffaCakes118
Size

11.7MB
MD5

f496c89aa5334459778a8f953be88b27
SHA1

2ce632053caf06bc4cbb28415827abacbb477982
SHA256

7105c4c9185aad09994f952cb5e2ffcbed3b6d8dab2a05dcaf01b289e66cbe03
SHA512

b4e1f61435709c0e80648863e5a355f5c064ec23111de04d248a8abf8ad3c8887ac56413041f8b0f2fee0c35a1531349fb50f5fed31d3227dcfadced1ebef9e1
SSDEEP

196608:xQ4CShjDc8sbq6vmamwL6zRYb9bUuWr90yiZhgyHYpfu00GUBiNEhzBpp:xQ4CmjfQq+mamwLyuBblWr9piZmZu0fg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f496c89aa5334459778a8f953be88b27_JaffaCakes118

Files

f496c89aa5334459778a8f953be88b27_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6baac9b755d85330c892d2e19b69687d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
EnterCriticalSection
GetConsoleSelectionInfo
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
VirtualAlloc

authz

AuthzAddSidsToContext

Sections

.text
Size: 799KB - Virtual size: 799KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 98KB - Virtual size: 438KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ