48e8065f3da571b616fc313b92ba1da8_JaffaCakes118 | Triage

Sharing

General

Target

48e8065f3da571b616fc313b92ba1da8_JaffaCakes118
Size

63KB
MD5

48e8065f3da571b616fc313b92ba1da8
SHA1

9105651814c375dbf2e3cb11626652859271a5b4
SHA256

7c74fac48b680daf98a7b8a439f799e015742319a2614240d1ea7fc7096a63ec
SHA512

df1fc041d672af704c420a968d6dd39858f79f49a109185634d7f250c0784103b969aeb916137a1d368a15bfa14a17fdc861d18ce16757453e4428128cafa942
SSDEEP

1536:XvauUu1/gM4WK5622MVkakt/90Wi31PVBKQrYnq2mU:XvaM1/gWKAweachFQrYqTU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48e8065f3da571b616fc313b92ba1da8_JaffaCakes118

Files

48e8065f3da571b616fc313b92ba1da8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

25fc06db12aefa980bedd424415f927d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyLZFile
SetLastError
LocalFlags
CreateFileW
NlsConvertIntegerToString
GetVolumePathNamesForVolumeNameA
WriteProfileStringA
FillConsoleOutputAttribute
GetFirmwareEnvironmentVariableW
WTSGetActiveConsoleSessionId

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE