004d375a9bffbc31b6be1222e76e546b_JaffaCakes118 | Triage

Sharing

General

Target

004d375a9bffbc31b6be1222e76e546b_JaffaCakes118
Size

76KB
MD5

004d375a9bffbc31b6be1222e76e546b
SHA1

b2846836a6e4e2380ee0af92ad3e68332faedf58
SHA256

3904200e5d7812c2c7394f2e8e8a217524ccec886add62776f5190615761476f
SHA512

ee166f8bf55e5c28926b5b29b7970a3a90d582c040f660943b9f64ef705ad2dfa967b2414d94385b4214bd8af9ef248cd02e8890e04c09122c942e14939b8521
SSDEEP

1536:anLDT2NStkW2kuTq9c6xrmaZZALB0o5pjVrs2ryrd1vUQuq6:anLmNF5krmaZud04Hs2qo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
004d375a9bffbc31b6be1222e76e546b_JaffaCakes118

Files

004d375a9bffbc31b6be1222e76e546b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

136e6956adbb61d4bc43ee83a8c3e0b0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstVolumeMountPointW
QueryActCtxW
GetEnvironmentVariableA
ReadConsoleInputExW
FindAtomW
GetVolumeNameForVolumeMountPointA
GetShortPathNameW
lstrcpyn
LoadModule
GetLocaleInfoA
GetOverlappedResult

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE