06a4cf314fbdcc158a4457ee76b5fc4d_JaffaCakes118 | Triage

Sharing

General

Target

06a4cf314fbdcc158a4457ee76b5fc4d_JaffaCakes118
Size

63KB
MD5

06a4cf314fbdcc158a4457ee76b5fc4d
SHA1

5b6f10794afdb5bc939f58a5d2018e6144f16bc6
SHA256

3fb74f597b51d11397c9c876f81d980d080ebcac1ea26041b931794231e10507
SHA512

ab9ee9b46c7acb3a5b84be46aab3aa072ec00507675d7e06face6895a54933d4c8a262b2e4724e66fb71515d7bdfa583b7a908a76e72380b2a123b9daf602fc3
SSDEEP

1536:jUK+ast35d9PqCfPkXR+A1INXIqQiFtNkR:jUKA5dZnfPkpAY+WR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06a4cf314fbdcc158a4457ee76b5fc4d_JaffaCakes118

Files

06a4cf314fbdcc158a4457ee76b5fc4d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c232c9c0f00b02353afebc7a1864ac65

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetThreadPriorityBoost
IsBadCodePtr
InterlockedPopEntrySList
GlobalMemoryStatus
SetFirmwareEnvironmentVariableW
WriteProcessMemory
lstrcpyn
GetNumaHighestNodeNumber
GetNumaAvailableMemoryNode
AddLocalAlternateComputerNameA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE