f9caf25e0ce0553c6969d24b60f9ba8a_JaffaCakes118 | Triage

Sharing

General

Target

f9caf25e0ce0553c6969d24b60f9ba8a_JaffaCakes118
Size

290KB
MD5

f9caf25e0ce0553c6969d24b60f9ba8a
SHA1

ba9bee21572b2cad7742ed691ccd7287f3257142
SHA256

9b7488e4efffc5a3ce782293d90afa665659bf0e1197aa06fbe0f8481ef9b1ee
SHA512

1035ad2cbff9995899aef30a9d9eff6f5ac156f49a6312225d0778728d67421fe0b0d111a8b49c3343db33426eb2471d7fde16c3256728c42b0dafab6e6c082a
SSDEEP

6144:67CYpS8fBTB8ObJkZP7cktI2hN+Hldu1N:yCEfB9jFkdckpbslYN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
f9caf25e0ce0553c6969d24b60f9ba8a_JaffaCakes118

Files

f9caf25e0ce0553c6969d24b60f9ba8a_JaffaCakes118
.exe windows:6 windows x86 arch:x86

76cb49957629b5fe0d40d13588a8762e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
WriteFile
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleW
GetProcAddress
LoadLibraryA
LocalFree
lstrlenW
WideCharToMultiByte
EnumTimeFormatsW
GetConsoleOutputCP
WriteConsoleW

user32

LoadStringW
MessageBoxW

ole32

OleInitialize
OleUninitialize

msvcrt

towlower
malloc
memset

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 966B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 922B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ