0625be05efded0225e3e368500f1213b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0625be05efded0225e3e368500f1213b_JaffaCakes118
Size

512KB
MD5

0625be05efded0225e3e368500f1213b
SHA1

4f7a9c59fa581b7a130cf628232821aba6cbcf36
SHA256

57a265d242249cb8bf1e503fd74fde95680d71cf0f3eccb7371f66968cb0ba25
SHA512

b16663c9633ceb86a9744b0b0dc893652a32cf6e5ad548cbf241c6054033cd94cb1ab87c07624b89d0f72877a70dc51dbe0627bc8f6444196dc2fdd22403a7bd
SSDEEP

12288:TlhDDDDDDDDDDDDDDDDDDDkxgXn+X5cDUvD2DqkLDDDDDD:TlhDDDDDDDDDDDDDDDDDDDkxgXn+X5Mx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0625be05efded0225e3e368500f1213b_JaffaCakes118

Files

0625be05efded0225e3e368500f1213b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6164eccbe399f72c80729fd6285377ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

7h4qMQ1edvEOY+wQIOdVR_v.pdb

Imports

mscms

GetColorProfileHeader

msi

ord29

kernel32

GetNamedPipeClientComputerNameA
EnumResourceNamesW
GetOverlappedResult
GetPrivateProfileIntA
GetFileAttributesExA
GetModuleHandleA

secur32

InitializeSecurityContextA

ole32

CoInvalidateRemoteMachineBindings

gdi32

GetObjectW

user32

GetClassLongW

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rsrc
Size: 448KB - Virtual size: 454KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ