312d3b95d8fd6fe82c4ef69be70ae8e0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

312d3b95d8fd6fe82c4ef69be70ae8e0_JaffaCakes118
Size

453KB
MD5

312d3b95d8fd6fe82c4ef69be70ae8e0
SHA1

a6536bc2a04209b011c592a42520b1968c4b1d84
SHA256

9f9ae9a74a60a25f64dec50a957c434d13b66405aa42abf5f88e003f4ccff90a
SHA512

95bcac243f148902a3c5be0a695aba443bce223294aefedda500da7181cd660f0f95516eed868c3f41bebd72df8172cb1890be2668e7dc8669e5be41755f631d
SSDEEP

12288:f2+SSow5GBk8dl4QJpLgcyuDiRfA1LiBn:9SSow5GOMjpLgCi6L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
312d3b95d8fd6fe82c4ef69be70ae8e0_JaffaCakes118

Files

312d3b95d8fd6fe82c4ef69be70ae8e0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dbcb39cb8071274789521cb14b674022

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtAllocateVirtualMemory
NtAdjustPrivilegesToken

rpcrt4

CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrDllGetClassObject
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer_CountRefs
IUnknown_AddRef_Proxy
NdrOleAllocate
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrCStdStubBuffer_Release
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow

Sections

.text
Size: 414KB - Virtual size: 414KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 960KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE