1a8f18105e89a628ef6c7d3eb627bb4c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a8f18105e89a628ef6c7d3eb627bb4c_JaffaCakes118
Size

275KB
MD5

1a8f18105e89a628ef6c7d3eb627bb4c
SHA1

b0e3643eea743733a8a23ad39c14bdf31aae3547
SHA256

71dcdd3a59df2965450b1a5d4ff5fcc579cddfa29cf168ab6d1081157dd87f49
SHA512

06b526227f624f1883590cbedc266358aeeefb6c5abddeec813382b5d8377f9fa533ef2c39c7a4bd03d358bc9e5fc21f054fddd89e42dbe9f4ea0f52c348d36f
SSDEEP

3072:YiYL41JfVRtAPLzdf3SbYpC+LGRmO39kcAtTtXL2pVw+wSi1DdgwPu0awvJ7:aL4bfVRY/df9A+LGRPA3GwSid6wPMoJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a8f18105e89a628ef6c7d3eb627bb4c_JaffaCakes118

Files

1a8f18105e89a628ef6c7d3eb627bb4c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

906ee369b0a7649e6774d4d20b382eef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetLogicalDriveStringsA
TerminateProcess
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetSystemDirectoryA
GetStringTypeExA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetTempPathA
GetTempFileNameA
CreateProcessA

rpcrt4

MesDecodeBufferHandleCreate

Sections

.text
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 807KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ