09fdcaa5fe4acdc95d68acb71aa2cc59_JaffaCakes118 | Triage

Sharing

General

Target

09fdcaa5fe4acdc95d68acb71aa2cc59_JaffaCakes118
Size

28KB
MD5

09fdcaa5fe4acdc95d68acb71aa2cc59
SHA1

4c0aa9f07617523e8cc30ca676b2efea94865e5d
SHA256

c063c19ba5e9483be5c10680e4508d638f3e9089eae539af2e8aa6dcba13f907
SHA512

cd678ccfa0acdbb392190b7354ef2177fdd866fc11be2300f576f30a6c719eef90c91ee82cf8b24aa3cd16c64c60fdabed8eae79819f38e496d59f24d897efe3
SSDEEP

768:/dCYBf5HlBW7GQjQzRaa1bdgerRzmR5H9aZ8m:VNBXwQkobd7RY9a+m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09fdcaa5fe4acdc95d68acb71aa2cc59_JaffaCakes118

Files

09fdcaa5fe4acdc95d68acb71aa2cc59_JaffaCakes118
.exe windows:5 windows x86 arch:x86

74f8ed1afade4f0a674521b62773be8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
FindNextVolumeW
GetShortPathNameW
ReadConsoleInputW
GetCPInfoExW
SizeofResource
GetCommandLineA
SetEndOfFile
DisconnectNamedPipe
VirtualProtect
RtlFillMemory
lstrcmpW

advapi32

RegRestoreKeyA
ImpersonateAnonymousToken
InitializeSecurityDescriptor
PrivilegedServiceAuditAlarmA
LsaLookupNames
InitiateSystemShutdownExW
LookupPrivilegeNameW
LsaQueryDomainInformationPolicy
WmiOpenBlock
LookupPrivilegeNameA

user32

WINNLSEnableIME
SetSysColorsTemp
GetKeyNameTextA
ClientToScreen
GetActiveWindow
UnregisterClassW
GetCursor
DialogBoxIndirectParamW
SendNotifyMessageW
GetWindow

Sections

.text
Size: 19KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ