404e1a009ec89df4d737e01581c8ba25_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

404e1a009ec89df4d737e01581c8ba25_JaffaCakes118
Size

68KB
MD5

404e1a009ec89df4d737e01581c8ba25
SHA1

2a2de54956030fea9e7bf6299783d2fd6bc75a49
SHA256

c7639101d77f98f0b0061055912a2eecedc1dee14de26bba1a4dda79648bd49b
SHA512

bb657ee09ddc6feed86d64c405e8ad9ea3431ecd94d79386365bbf03b9c972e3c763ba66bf857544c2646bc01284e82f0ff433ea2d0bd9d74f3ad1055e338ab5
SSDEEP

1536:aZsB5wcTSTTDKNCWQPn33ouxu2DZ8xJmfG9if:ksbw5HYy3z9eg6if

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
404e1a009ec89df4d737e01581c8ba25_JaffaCakes118

Files

404e1a009ec89df4d737e01581c8ba25_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1900d6bf34c77e05b1d9673e7f335dfe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryW
ContinueDebugEvent
GetFileAttributesExA
lstrcpynA
FillConsoleOutputAttribute
lstrcpyn
GetEnvironmentVariableW
GetConsoleAliasExesA
EnumSystemLocalesA
WriteConsoleA
GetEnvironmentVariableW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 36KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE