47b054cd85d55575508dc9a7ae288c02_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

47b054cd85d55575508dc9a7ae288c02_JaffaCakes118
Size

40KB
MD5

47b054cd85d55575508dc9a7ae288c02
SHA1

5bd260f01578cd6d189ae12772bd3bfcbee62b61
SHA256

68e1d0d033b3b7f60c7002585294bb8dee56c1bc73004474206c805351c51e84
SHA512

d588c2597079c1a37dfec7cc2b904d5a1c831ee1823ff30f49edfee0573dbe61bc154e390ff79613ea1ab76177348d9384aabb7c1a575f4a543078c9e624b434
SSDEEP

384:eyh0tDxuWS4mW1jaW4am3JFMKZvAYK4ybSUoUNAsnDag7xyoddEkP5gcppZSL:eO6DV6aUFMKxAYwuUNAsn2ixUkRdUL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47b054cd85d55575508dc9a7ae288c02_JaffaCakes118

Files

47b054cd85d55575508dc9a7ae288c02_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f8a0f7aa2e68a0940bb04e374d8b4c55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtQueryDirectoryFile
NtAllocateVirtualMemory
RtlAddAccessAllowedObjectAce
RtlAdjustPrivilege

rtutils

TraceDumpExA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE