4b70f83599510d7a5e8835a3f54138b8_JaffaCakes118 | Triage

Sharing

General

Target

4b70f83599510d7a5e8835a3f54138b8_JaffaCakes118
Size

422KB
MD5

4b70f83599510d7a5e8835a3f54138b8
SHA1

b2b1bacca6baea0868b0f709d6570ea361fb6cc0
SHA256

35a3cffedae27c865d539e4a17941bd56de3a957900ed4dd162fc2150a69dbb2
SHA512

5547f4737133fde3cf2f5b6e063305d75cffe0071b69b2c78e1cfbd978b8cf51d28542933117e2a124aec3ec27046eb1f9a4124177644b642afa93d9e86f152c
SSDEEP

12288:H3BEaZsRDHux7TSFqq2x49QTLpzkvFMPVrk7e0yk:hZsRDi7Tiv2x4eyMdrk7e0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b70f83599510d7a5e8835a3f54138b8_JaffaCakes118

Files

4b70f83599510d7a5e8835a3f54138b8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

932c51fe25abb34aab62cedd138bdd07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
IUnknown_AddRef_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Invoke
CStdStubBuffer_QueryInterface
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
NdrDllGetClassObject
IUnknown_Release_Proxy
NdrOleFree
NdrOleAllocate
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Connect

ntdll

NtAllocateVirtualMemory
_itoa
NtAdjustPrivilegesToken

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 230KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE