25af0000a905ea30dcffe1c019bd5fc8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

25af0000a905ea30dcffe1c019bd5fc8_JaffaCakes118
Size

56KB
MD5

25af0000a905ea30dcffe1c019bd5fc8
SHA1

0fee1f486e89cd1916bb632ea8beeeed76b2ea9b
SHA256

0d09dea2c86e95d02e981535f7c336b13945e9bfb07324532ed1799b269c3c4c
SHA512

7562b82f78c524f5ecf39e354da145a4c6dff23aaef707fe178cbfd817254f6e27d3ba02ba4cde435e26c73e8fbced271c43715f139bc1d8479541a5090b1b8b
SSDEEP

1536:AVblSnij43wX/8T0zj4mn4yhY5GYky1bA:ASnoTP8w4mn4YYAY5u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25af0000a905ea30dcffe1c019bd5fc8_JaffaCakes118

Files

25af0000a905ea30dcffe1c019bd5fc8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

814a8c5346486718f7e4d2c7482310c9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
UpdateResourceA
SetConsoleTitleW
Toolhelp32ReadProcessMemory
HeapFree
UpdateResourceA
InterlockedExchange
ExpandEnvironmentStringsA
SetThreadIdealProcessor
CreateHardLinkW
SetTapeParameters

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE