1b0f2a0ca83d785da070237c8c1d4ef7_JaffaCakes118 | Triage

Sharing

General

Target

1b0f2a0ca83d785da070237c8c1d4ef7_JaffaCakes118
Size

378KB
MD5

1b0f2a0ca83d785da070237c8c1d4ef7
SHA1

fa91677e58fe38362540d78c15a4d3b0378bc806
SHA256

6d40e81d560a3d167bc1ed61eb8d9443a5e2d6e7920cc19b9c5b495901069d2c
SHA512

ea395e86919bac00601a8e81d043412c38a397d7d6078d9bacbdf5a0d7ce661de1ef08ce366166ba974826b74e43b19b7572a4744f7cb2c474f81bf6f93e3092
SSDEEP

6144:aBsqUsLDaPvDLocJaCPq2KSNs7i4WFqazinLEvUwe5lqTqSOuDjj:HqUYuPrgtQlgLE8we5gqxuDj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b0f2a0ca83d785da070237c8c1d4ef7_JaffaCakes118

Files

1b0f2a0ca83d785da070237c8c1d4ef7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1e06836cf80668b47265ef21b208cc75

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsValidLocale
VirtualProtect
ResetEvent
TlsGetValue
ExitProcess
SetEvent
GetProcAddress
LoadLibraryA

Sections

.text
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ