10216a640372f6c8ecdeac1222640388_JaffaCakes118 | Triage

Sharing

General

Target

10216a640372f6c8ecdeac1222640388_JaffaCakes118
Size

55KB
MD5

10216a640372f6c8ecdeac1222640388
SHA1

8caf2904dc197ea0124a7378ebf4e369cde9e2a2
SHA256

1dd9400814e60ace1e4ce4b8a1c7f774d799291e34a9152f3579158beda9cc57
SHA512

b2eb437edc72c559865f090275799a85eca360c1ebd6df683cf869c0bf807a9ac6c5ef062832687047552afb302d8e5606787e601a47a5d6cc2f3757c8b5bd03
SSDEEP

1536:hcP/75fXM/VM8wj7UWY4yD8u93qBFvz+rcOH8:W75fuf8U4yD8uFqqrc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10216a640372f6c8ecdeac1222640388_JaffaCakes118

Files

10216a640372f6c8ecdeac1222640388_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9986fc37d0bdf9f617552fba17b266eb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DebugActiveProcess
GetConsoleAliasExesLengthA
GetConsoleAliasesLengthA
lstrcpyA
FindNextVolumeMountPointA
LoadLibraryW
GetCommandLineA
ExitProcess
GetStartupInfoA

Sections

.text
Size: 5KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE