2599715e41108a239dbb2168409a45e2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2599715e41108a239dbb2168409a45e2_JaffaCakes118
Size

459KB
MD5

2599715e41108a239dbb2168409a45e2
SHA1

70d64469924d04541e83b603f6e96649f18d9c36
SHA256

f8fa091e213aa5cbeac224f8af4337f891ca719c2769ea84f30af31944e5a01d
SHA512

2ed7f496519cd8771b9ffc64be8dfa7cca53eb540ba2cec912359519053e7cdbd9ff66531761d584d0a730710f5c8c4102e993747dbde99cec03da92dca09201
SSDEEP

6144:132grmZzPSC5gRi8d3VGHnWtkwaauFHgPvbkqqM:sgqZLpD8dFwnWCEu6ruM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2599715e41108a239dbb2168409a45e2_JaffaCakes118

Files

2599715e41108a239dbb2168409a45e2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2c0f274976c117fb5ac97699c9868bed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

herklLEGHKWR#;3kl.pdb

Imports

advapi32

QueryUsersOnEncryptedFile

msi

ord30

kernel32

SetSystemFileCacheSize
IsWow64Process
DeactivateActCtx
GetModuleHandleA

gdi32

CreateBrushIndirect

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 177KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ