f3aa562459cae7f4cbe15db0b13a5984_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f3aa562459cae7f4cbe15db0b13a5984_JaffaCakes118
Size

83KB
MD5

f3aa562459cae7f4cbe15db0b13a5984
SHA1

f5ba0d5a710b18a8dde5df29602d599ac74e5053
SHA256

b00a943fa51c7e4a34eceb1ce68cdb394dcc4ec6db00df0dc989e9d180e79b58
SHA512

9f66d886b9351a7f1055affe3050f3941e6605ea4407c91f4fa5180e295b197c6def861da2b1694b3c08d12f0cd3aabb1525e732b42c93851bbb9575f48c58d6
SSDEEP

1536:cVnmgKjTYlPCu4F+4HzCJNWDjiCdvlql+JIuljow/aKEx+dHsX4wvXlAe5GOSJd+:pzhgq+Lw6zA2RVI3gjBkMqhGKZTbbc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3aa562459cae7f4cbe15db0b13a5984_JaffaCakes118

Files

f3aa562459cae7f4cbe15db0b13a5984_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c3b378374a047b215aba7ab811758023

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadDirectoryChangesW
GetSystemTimeAsFileTime
GetConsoleAliasA
DeleteTimerQueue
CreateRemoteThread
FindResourceExW
EnumUILanguagesW
FindVolumeMountPointClose
InterlockedIncrement
SetConsoleInputExeNameW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zrdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE