a4483c2583cec576bff3b5021d11e23b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a4483c2583cec576bff3b5021d11e23b_JaffaCakes118
Size

31KB
MD5

a4483c2583cec576bff3b5021d11e23b
SHA1

1017a8e5eb7bfa304382a09de9ae7d3dedcb6875
SHA256

797d8d5dd121bafb1c7fca48140b2f7ee29ab2b6b0c90242d01c88a737bf317a
SHA512

093c60424451f363cc0e3dc64e74a739571bfaf24dace09b05af3c139b42f9ec4b6c03c900f4e418c713bc3bd6dc348cbf58a3b1684e5966a5c00df64a09a3be
SSDEEP

768:DwbiayStty4fKF34t+7D7cNTZOfuX2VzbG80C:Dwbia2CKF742Vzb9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4483c2583cec576bff3b5021d11e23b_JaffaCakes118

Files

a4483c2583cec576bff3b5021d11e23b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

48b4a8b0d5f2de406f0e591abaad41a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

wiretap-1.8.0

wtap_read

shell32

SHGetSpecialFolderPathW

libwsutil

getopt

libglib-2.0-0

g_log

libgmodule-2.0-0

g_module_error

libgcrypt-11

gcry_md_ctl

msvcr100

exit

Sections

.MPRESS1
Size: 11KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE