47165f79414d5e1a6081273f2bb0754f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

47165f79414d5e1a6081273f2bb0754f_JaffaCakes118
Size

442KB
MD5

47165f79414d5e1a6081273f2bb0754f
SHA1

a6c8c69a3589fcb38eaa2c26f160253fd51a2b6a
SHA256

7157d358830e1d3bbb94b12fa78899b07d1997519b3c9bc7a6a8fe8fe4f98f47
SHA512

f186481376f8cf52c9f182290f84f30d223c49fba1de1de569f60a54246ab30f69345c161d3d9d2ff6e0e957fbbe7db5f88d515ee3414e29b01aa89c9fc6f653
SSDEEP

6144:mE5IQM2EuJ4aYkSzg+S8Hb5oaUP76mysQokrQHFyBayo+YSHfMzbwDZliffMou:/5InjnakztSstoapmqcHFyU3+czkF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47165f79414d5e1a6081273f2bb0754f_JaffaCakes118

Files

47165f79414d5e1a6081273f2bb0754f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b7162e5eb159d57b479f5baa68a17d13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
VirtualAlloc
GetConsoleCP
GetProcessVersion
LocalFileTimeToFileTime
lstrcpynW
Module32Next
FindNextFileA
WriteFile
CreateProcessW
ExitProcess
UpdateResourceW
CopyFileW
GetProfileIntA
GetCommandLineW

mssign32

PvkPrivateKeyAcquireContextFromMemory
SignError
FreeCryptProvFromCert
PvkGetCryptProv
GetCryptProvFromCert

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CRT
Size: 5KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 310KB - Virtual size: 472KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ