0e83d13c4760d6780bdf61df96615446_JaffaCakes118 | Triage

Sharing

General

Target

0e83d13c4760d6780bdf61df96615446_JaffaCakes118
Size

799KB
MD5

0e83d13c4760d6780bdf61df96615446
SHA1

08b09de9147697adaaa66df1ca5a828c48e69f0f
SHA256

71d7c7dbd1e3c3053da20948ec26d9f4f523d598a75b5552a026d7a5f2dbce70
SHA512

6d2daeae984eb2e4586c98600f69d177b24de032a18bde7b825d986c4eafc5a8985bc6989a3ec4ded3229a91bcb0d556cb94b8f3152ecbf73800a48e9462d3c8
SSDEEP

24576:UQvPrOqokz3NBA7T/jjTYwqRrzPMpVraLVwdFUZZog:bvTO6BA7TMBRPIVraLVw4Zj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e83d13c4760d6780bdf61df96615446_JaffaCakes118

Files

0e83d13c4760d6780bdf61df96615446_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d74af08b25e34adc349d1735728a0a22

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3

kernel32

WaitForSingleObject
CloseHandle
WriteFile
CreateFileA
CreateThread
lstrcatA
GetLastError
CreateMutexA
lstrcmpA
lstrcpyA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetModuleHandleA
IsDebuggerPresent
GetCurrentProcess
lstrcmpiA
HeapFree
GetEnvironmentVariableA
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetProcessHeap
lstrlenA
GetProcAddress

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 784KB - Virtual size: 784KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ