8e2ee1038a38f7f0b5537a965e366b52_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e2ee1038a38f7f0b5537a965e366b52_JaffaCakes118
Size

457KB
MD5

8e2ee1038a38f7f0b5537a965e366b52
SHA1

f5d841826836b706032de4a11cc69e94c4fb821b
SHA256

1f3fc7159fce7bca1fb0b6b740dea75749c68194d0684dd0167de5671c261ead
SHA512

7ac12f42efb211eceb17b76b9aaf80079ccd6412be4e0a51a5c75f40682d7d0c124480de52cebc87f0f308301c376e2c7adb5c3555795831a6a47f521cadb8e1
SSDEEP

6144:iwt1iI9T4gh8trVcFi2M/E1y6GlLICuqgX9MqDfQ8M:iG1iMT4wAcFtM/wy6SLg3DY8M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e2ee1038a38f7f0b5537a965e366b52_JaffaCakes118

Files

8e2ee1038a38f7f0b5537a965e366b52_JaffaCakes118
.exe windows:5 windows x86 arch:x86

32b62fa99c71b3de2bcf9f1fd0b25d7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

herklLEGHKWR#;3kl.pdb

Imports

msi

ord30

gdi32

CreateBrushIndirect

advapi32

QueryUsersOnEncryptedFile

kernel32

DeactivateActCtx
GetModuleHandleA
SetSystemFileCacheSize
IsWow64Process

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 177KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ