2a19f944680d94342f19e73c123bd313_JaffaCakes118 | Triage

Sharing

General

Target

2a19f944680d94342f19e73c123bd313_JaffaCakes118
Size

1.2MB
MD5

2a19f944680d94342f19e73c123bd313
SHA1

a007b135dec38013bf115194359fd02f2e136db2
SHA256

53eb88c55560f4ab42b7eba647f3d4aee7151cdc919ea83fff7b6263659d3429
SHA512

573506afe3bbe7eb5768b9d3fff7733be2046de482774060bf26d63976e6ec66e50a7183f5747312c549bc939f25bb99c0e9c2f779b038c645a3409163edd903
SSDEEP

24576:6S/jrAhMV1CWJ6pi+JjBSdIcctk6WSZyJEzchzei5lLgJlQrVn1AP:6SrrAeVIXY+7sIj66Wwy2zcRe+lLgJam

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a19f944680d94342f19e73c123bd313_JaffaCakes118

Files

2a19f944680d94342f19e73c123bd313_JaffaCakes118
.exe windows:4 windows x86 arch:x86

af6814a8d7f091e1d89d829ba7827d7d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
VirtualProtect
GetModuleHandleA
ExitProcess
SetConsoleScreenBufferSize
GetStartupInfoA
GetModuleFileNameA

advapi32

GetTokenInformation
ReadEventLogW

Exports

Exports

WriteJglloba
GetYlaapcyhr
EndLqhdlarxlq

Sections

.text
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ldata2
Size: 352B - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enull
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ