0bfcff716c9d959b5030ac59e80d1804_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0bfcff716c9d959b5030ac59e80d1804_JaffaCakes118
Size

62KB
MD5

0bfcff716c9d959b5030ac59e80d1804
SHA1

4acf16192c1fc8952804ecba61686d69b6f23799
SHA256

ef42a1ba4964cb2686c985773a89227ad9f0e9ef6e53ed76ce0c304ffc2bfe5f
SHA512

7a8c3e79d8a8dd45c2ae34a253460e7d767f9a8d48ae0d90cdf48dfc1a5387d569b0a9d6715ba662e937b4730afe25b61a1455b0d8145f82af4532787bd5f42b
SSDEEP

1536:gkE2LHbMAx96d711/vjKdPmCTaNEhV806Qiap8hNgJABILlZeTs/xV:FLHbMAad51XAp1Fp8vQ/xV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0bfcff716c9d959b5030ac59e80d1804_JaffaCakes118

Files

0bfcff716c9d959b5030ac59e80d1804_JaffaCakes118
.exe windows:4 windows x86 arch:x86

21ba66e97396cb74a268933879ef9c2c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateNamedPipeA
GetComputerNameA
EnumSystemGeoID
SetComputerNameExW
SignalObjectAndWait
SetVolumeLabelW
SetThreadContext
CreateProcessA
GetVolumeNameForVolumeMountPointA
GetProcessVersion

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE