1b33d8092f098c7b9075b19e339cb44c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b33d8092f098c7b9075b19e339cb44c_JaffaCakes118
Size

525KB
MD5

1b33d8092f098c7b9075b19e339cb44c
SHA1

43b133ab90ebb52a1dfc885c989796b617abe6a6
SHA256

1ca6113da8a3e031edfced097daa7b40bb51704d2286031da29b861399d7f1a8
SHA512

9334bc44c9099b78c331cf66de19e029445b721afd3c3e86be563d4e8aee48683b6fcce5d981d588ad01ffa03c957e0864fe1607a9930a3fb4064f8c0802106a
SSDEEP

12288:ZNq1cWq8PKpjY/H7PuRfbvrUjViQ10l2ouo3l:+1fPj/7WdbvrUj8r2ro1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b33d8092f098c7b9075b19e339cb44c_JaffaCakes118

Files

1b33d8092f098c7b9075b19e339cb44c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6560700f94c82fc0e49e62badbb5eeb6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtAllocateVirtualMemory
NtAdjustGroupsToken

kernel32

Sleep

rpcrt4

NdrOleFree
CStdStubBuffer_QueryInterface
NdrCStdStubBuffer_Release
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
NdrDllCanUnloadNow
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
CStdStubBuffer_AddRef
NdrOleAllocate
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_IsIIDSupported

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 346KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE