face933947065f83f6fe563025699cf1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

face933947065f83f6fe563025699cf1_JaffaCakes118
Size

61KB
MD5

face933947065f83f6fe563025699cf1
SHA1

a482c7a8e5abf524e48aec07b06ed9dbb6f4ec78
SHA256

6c899e12b32244b7c90ea76f3b4c4ad150d3f71c521a57b6996e2f2780cfc5b1
SHA512

0f924e740e8e750ed3c9099291498dec855376f051f0279a84975406b1b3b4c6f1250b3b79c3b24893009ea1945a134426356082a633b258589111171b44212a
SSDEEP

768:RLw9Lw9Lw9LwhLPkJFGFqeuGcEI/p44dLcaUbO+07eKOT9bdgxf64SPvK1irREjT:GGFEgaeZd269Pv5foaTq7rvJnxhx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
face933947065f83f6fe563025699cf1_JaffaCakes118

Files

face933947065f83f6fe563025699cf1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6321e686d984fbf3b8b8e699481a22ff

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryDosDeviceA
RemoveLocalAlternateComputerNameW
BackupSeek
GetUserDefaultUILanguage
GetVolumeNameForVolumeMountPointW
FlushInstructionCache
SetVolumeLabelA
GetDiskFreeSpaceA
GetFileInformationByHandle

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE