41cad8e4dd3d58d1051aa2c52538e422_JaffaCakes118 | Triage

Sharing

General

Target

41cad8e4dd3d58d1051aa2c52538e422_JaffaCakes118
Size

187KB
MD5

41cad8e4dd3d58d1051aa2c52538e422
SHA1

889b2265359909e8dc2d7f3aa943efc9f5c4466f
SHA256

4dfbbad41276b317f2c1b9213f5e73e60d0d1744931d4cab08de3cd248809e46
SHA512

d4a9663c41848864c08614a67c4995ba13ce34b1afae2b4609eea78f54fbd389bf364f1979e247068d6a240dde753a436d7947a8015a56a1f61d200ba7d1c171
SSDEEP

3072:iKnvF90eeUpYtEeUg3OqCG2jSU+xUCBDyT4fMD20sh0oBPbsNvqy5/B42Fclpa:iEvFqgpGI3qCG2jQzDyTRinOoBjsNv99

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41cad8e4dd3d58d1051aa2c52538e422_JaffaCakes118

Files

41cad8e4dd3d58d1051aa2c52538e422_JaffaCakes118
.exe windows:4 windows x86 arch:x86

db79f2a54e6f138902e39f649b47656e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WritePrivateProfileSectionA
OpenFile
SetConsoleNlsMode
BuildCommDCBA
GetThreadSelectorEntry
FindCloseChangeNotification
TlsAlloc
GetConsoleKeyboardLayoutNameW
GetDriveTypeA
HeapCompact
GetStartupInfoW
ReadConsoleA
CallNamedPipeW
Process32FirstW
MoveFileExW
FileTimeToDosDateTime
MapViewOfFileEx
GetVolumePathNameW
EraseTape
GetCommandLineA
ExitProcess
GetStartupInfoA

Sections

.text
Size: 5KB - Virtual size: 821KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 178KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE