f6377706e948dfdd68e45474e8e21c13_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6377706e948dfdd68e45474e8e21c13_JaffaCakes118
Size

83KB
MD5

f6377706e948dfdd68e45474e8e21c13
SHA1

049908eb69f9c260bb5e78f27acf11203d9479e2
SHA256

54ee155a14478b9df217652c153e8792d209af9503d480a5d985271982f2fb45
SHA512

041b49e730815a9b98537f65b3099be27c4c91d51a6e90cdb664a49b34d88369d3e401de93572bb47d48e2271ec2190e33c00fc88dc750d91d94001f7d5f10e8
SSDEEP

1536:mfQlZXBJsnAOmSAu0sGD/cvd/wYypjVrs2ryrd1vUQuq:DNm/mPu0t/cvd/2Hs2q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6377706e948dfdd68e45474e8e21c13_JaffaCakes118

Files

f6377706e948dfdd68e45474e8e21c13_JaffaCakes118
.exe windows:4 windows x86 arch:x86

eb00449bd4bbe6d0c849395e03864f3e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TermsrvAppInstallMode
HeapDestroy
GetConsoleMode
GetPrivateProfileStructA
LZSeek
IsWow64Process
ConnectNamedPipe
EnumCalendarInfoExA
GetConsoleAliasExesLengthW
InterlockedPopEntrySList
SetConsoleNumberOfCommandsW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE