darkcomet | ff19c0a2dd1e82d060b918ce020ffad5_JaffaCakes118 | Triage

Sharing

General

Target

ff19c0a2dd1e82d060b918ce020ffad5_JaffaCakes118
Size

567KB
MD5

ff19c0a2dd1e82d060b918ce020ffad5
SHA1

bc17cdc14763588be8b4424c3a91e73531d6a395
SHA256

00298def79a88e2ddba433aa4c7c5477931c4af9c47bffc775c2442b9114a5fc
SHA512

ccc960c625a376ec1837b8a4308fdd6be876c20ff10ae4bfe05ab0dbf6879b2eae5d03120a0c6606874281bc3267373156f6555fa281dc7991950d606c8d573f
SSDEEP

12288:rpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnl/TMMXG91uhKIc:dwAcu99lPzvxP+Bsz2XjWTbMQckkIc

Score

10^/10

darkcomet

Malware Config

Signatures

Darkcomet family
darkcomet

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
ff19c0a2dd1e82d060b918ce020ffad5_JaffaCakes118

Files

ff19c0a2dd1e82d060b918ce020ffad5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 563KB - Virtual size: 563KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 46KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 52B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ