4981b3bd0fb67b4e74dc657d281b3b48_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4981b3bd0fb67b4e74dc657d281b3b48_JaffaCakes118
Size

87KB
MD5

4981b3bd0fb67b4e74dc657d281b3b48
SHA1

32aae266c2c89c034fa5ba43a159e0b88cd5e54e
SHA256

d5ac2abf26578697ea1f88936c9c078eb3a50e62734fc0c3b116fa1641b65051
SHA512

b5f222d7c6862bf2f02ad893cadefbcfdfc9885a45cfa93b009dbff55a0e819dfeb3e6ad3411c80dc5aae310887a525d3e133a1a5872bc9d37d6a6e146f13d31
SSDEEP

1536:dOHGk85vTMqw2W8zvAMz2Rcu4+j44oiq6C+dBjEErxTWDTMqhGKYIZTET8FVxdJC:dOI5bLw9ZMacu/1o0NjBkMqhGKZTbzx+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4981b3bd0fb67b4e74dc657d281b3b48_JaffaCakes118

Files

4981b3bd0fb67b4e74dc657d281b3b48_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e1af9b5bd38117ffcb279374cd5ae94c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleInputW
IsValidLocale
GetCommandLineW
SetThreadContext
PulseEvent
FindActCtxSectionGuid
ShowConsoleCursor
GetBinaryType
GetProfileSectionA
lstrcpyn
ConvertThreadToFiber
MapUserPhysicalPages

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zrdata
Size: 31KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE