0d5974d7272b10b18e2ccf197ad71512_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d5974d7272b10b18e2ccf197ad71512_JaffaCakes118
Size

62KB
MD5

0d5974d7272b10b18e2ccf197ad71512
SHA1

3a2fd7f3b198462dbdaa16c4e37dffb1db1e7f94
SHA256

9499ad7d93bf9734d4398c630c1f6ccdfeaf86cbb408e8fa9aee8decc8126543
SHA512

9de82b5b7ca8a78e2c067554e37bb72ca3491fe4106a120f867389337af7cd6bf72a6ff0e579ddd4862790aae3def71d1d1b95c36b526aff0762175d2ad217d3
SSDEEP

768:ib7ZkkeZ2Pv3yULc54x4nrQPGpyeDmmvs1j7V5Af0Xh0OxLj8Ao12hKCmvJh/jn6:IRT4nNp9DDUssbLjto1CHm3j4Ynbq1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d5974d7272b10b18e2ccf197ad71512_JaffaCakes118

Files

0d5974d7272b10b18e2ccf197ad71512_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a52ba7f0ab8ce48b67dfe61d304ee4c0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAddAtomA
ReadConsoleOutputCharacterW
_llseek
RtlFillMemory
ReplaceFile
LockResource
RegisterWowExec
CreateMutexW
FindCloseChangeNotification
InterlockedCompareExchange
lstrcpyn

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE