3398c0392f538abc5d1c85b923b376e8_JaffaCakes118 | Triage

Sharing

General

Target

3398c0392f538abc5d1c85b923b376e8_JaffaCakes118
Size

96KB
MD5

3398c0392f538abc5d1c85b923b376e8
SHA1

ffc62be09980126a3c3c607b599d84401a33d9b4
SHA256

79c9ab92d3cc3721e455a8e52ca849546aa035f4d6ff51f891496fc36ed780fb
SHA512

4da1243955610e271d9578b87c3672474d25b98a1ca8b4182422a20cfcad779a2eede0b1df04fd8049fd65820a995e574aace4b2e530252209da2c40cef1498b
SSDEEP

768:kWViQ1E/QyHLYUH8Zg0vWbGgSGaJr5pytgOMbkMQ7ZSfW7ebe4MyN9H6SxJhIubL:9tpr53hgM4ZSjTht2IJTxBHpVSK64f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3398c0392f538abc5d1c85b923b376e8_JaffaCakes118

Files

3398c0392f538abc5d1c85b923b376e8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c0f1f9b447b270b9de48c3913e460f7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
TransactNamedPipe
IsValidLanguageGroup
GetConsoleCharType
BackupWrite
TransactNamedPipe
LeaveCriticalSection
SignalObjectAndWait
GetMailslotInfo
WritePrivateProfileStringA
CloseHandle
ExitProcess
GetStartupInfoA

Sections

CODE
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

WEIJUNLI
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA