47ff36a6ec6c753c286e3d3b1163834a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

47ff36a6ec6c753c286e3d3b1163834a_JaffaCakes118
Size

13KB
MD5

47ff36a6ec6c753c286e3d3b1163834a
SHA1

81f9b1723b1cf333bd541b6d2ace21d2df796ba9
SHA256

93326bbadc796b923a15c252bed375f95a57526928a54c2f48fb0d24d848bcce
SHA512

580dd005ccf44993bd2d6295cc804226162c4489af96dfd80d1762ebe51d319782576cf3940aae6fcba34ae608e76c011a3edaaa346257cd33acf9f6a3dfb2ff
SSDEEP

192:lbu3z0657Tosy5deByJSeFEQuq6buePcMIdfkenEZllJSUfvLUaB9V3hEqRYp:puDv57ToPfEP7uePEf7KHxfvLXV37Yp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47ff36a6ec6c753c286e3d3b1163834a_JaffaCakes118

Files

47ff36a6ec6c753c286e3d3b1163834a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

582994574306dc07be97f0266372a204

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

pegservice

??0ServerProcess@Pegasus@@QAE@XZ

pegserver

??0CIMServer@Pegasus@@QAE@XZ

pegconfig

?getInstance@ConfigManager@Pegasus@@SAPAV12@XZ

pegcommon

??1Thread@Pegasus@@QAE@XZ

msvcp80

?uncaught_exception@std@@YA_NXZ

msvcr80

exit

Sections

.MPRESS1
Size: 11KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE