f6c558e8ff641cdb0b5920716422f269_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6c558e8ff641cdb0b5920716422f269_JaffaCakes118
Size

83KB
MD5

f6c558e8ff641cdb0b5920716422f269
SHA1

1090775caefcbbc1c7a09d95982f83903146e301
SHA256

71842a39a415039b4660d82512ea28dea166f91fc07e2da0d136e8086fbbdadd
SHA512

1612f0f753d56801fddf863af5af2f29baf2907e94fd3058fa92431eeb623db519633fec0127a5ce321fb25d6b863faa5744d93c96a7e32a9d95f78525c815b2
SSDEEP

1536:IBibnQr6I/5uDD54YHgDrOr2QbYcpjVrs2ryrd1vUQuqwcizSkX:TQOT4y8TQbYcHs2quciu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6c558e8ff641cdb0b5920716422f269_JaffaCakes118

Files

f6c558e8ff641cdb0b5920716422f269_JaffaCakes118
.exe windows:4 windows x86 arch:x86

357cb946ce86f34814c84c8cfed3e00e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateVirtualBuffer
RequestDeviceWakeup
RaiseException
VDMOperationStarted
GetLocaleInfoW
HeapUnlock
ZombifyActCtx
NlsResetProcessLocale
SetConsoleOS2OemFormat
GetAtomNameA
WriteFile

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE