4820608c678480fd0bdc76ad511cfb91_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4820608c678480fd0bdc76ad511cfb91_JaffaCakes118
Size

26KB
MD5

4820608c678480fd0bdc76ad511cfb91
SHA1

32b59f305c107a298183b1483d50bda0963a9415
SHA256

127ad616532300833903fb88281f013151a20819a7255bc0ed73c59c9893f11d
SHA512

499723fb552b3f9cf21f34ae47348351e583fd6db0bc62ef0582b8979d375fa7c3f22ea49b91db0ae6c90226e7da05008fdeb9117d0a04663783efb3600d9c9f
SSDEEP

384:K8od2TohTVEqI/CTYVle4QCCbX6HrzY2MsNteZHCFUCRT2gjI0UYcp:K8ocuig34QCPHrk2MsHaitsT0Sp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4820608c678480fd0bdc76ad511cfb91_JaffaCakes118

Files

4820608c678480fd0bdc76ad511cfb91_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3d8d7beb5fc06d08585103c361dc4565

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedExchangeAdd
IsDBCSLeadByteEx
ConvertDefaultLocale
BeginUpdateResourceA
OpenMutexW
SetFileApisToOEM
GetVersion
ReadConsoleOutputA
GetCurrentProcess
EscapeCommFunction
CreateWaitableTimerA
EraseTape
SetLocalTime
GetThreadLocale
GetComputerNameW
GetConsoleCursorInfo
SetThreadContext
GetProcessShutdownParameters
HeapAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ReleaseMutex
GlobalFindAtomA
HeapFree

user32

LoadCursorA

comctl32

ord17

msvcrt

_except_handler3

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 414B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ