4934436755f468ebe6543c7522a03b70_JaffaCakes118 | Triage

Sharing

General

Target

4934436755f468ebe6543c7522a03b70_JaffaCakes118
Size

16KB
MD5

4934436755f468ebe6543c7522a03b70
SHA1

8ac47b9c078ae66a38a8031e20ef2bd7588afbf1
SHA256

3c4334ad5b83c47495cdc41c0e9464ba7f7d01057f195784950c87a94ed8e872
SHA512

98aa2fee991dde6661b2bafa91411f921c9b5c62264cea2e023bacc35341b9d50d287f0a897b768c4def188fbd6af2690d5e8e6b17da36c46be934ddd4695d7c
SSDEEP

384:BwpwT4dvthmGoOC0QgdTsOt4nqHSjSyhkA0PtwX:xT4dv7mGoOCtgt+nqFyGA0lA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4934436755f468ebe6543c7522a03b70_JaffaCakes118

Files

4934436755f468ebe6543c7522a03b70_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f0f771634c9020ca426000589ebf13e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCreateFile
RtlNtStatusToDosError

crypt32

RegQueryValueExU

kernel32

VirtualAlloc
FreeConsole
HeapFree

activeds

FreeADsMem

Sections

.textbss
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ