4d071ae2a58c1051173bcdd666a74f5a_JaffaCakes118 | Triage

Sharing

General

Target

4d071ae2a58c1051173bcdd666a74f5a_JaffaCakes118
Size

50KB
MD5

4d071ae2a58c1051173bcdd666a74f5a
SHA1

430bab71b97c41be41db04d8cf6244500626c200
SHA256

cbc051e3c21adcad5b4fc0a843132167d7b4144983de60de086afac941d9bb07
SHA512

47a3e15c8447e0cd50a4d3544a3c81521ea08a55a4efb24c8dcecc712a8b82d7407a7996ae0ca599924a2ed8ea10061ddae1cfb5ea19d4882c6c52e94a5813f1
SSDEEP

1536:ri7HJy2LU1U/kI5g0qpfvUJNkhu9WETXh:ri7p7LUe/r5g0qpvhd+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d071ae2a58c1051173bcdd666a74f5a_JaffaCakes118

Files

4d071ae2a58c1051173bcdd666a74f5a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d8133c2272df998780984a8ddb8ea2af

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateProcessW
CreateTapePartition
ExitProcess
GetVersionExW
LockResource
ReadConsoleOutputCharacterA

advapi32

EqualPrefixSid
GetSecurityInfo
IsValidAcl
LookupAccountSidW
LookupSecurityDescriptorPartsW
RegEnumKeyA
RegUnLoadKeyW
StartServiceW

shell32

CheckEscapesA
Control_RunDLLA
DoEnvironmentSubstA
DragFinish
DragQueryPoint
OpenAs_RunDLLW
PrintersGetCommand_RunDLLW
SHGetPathFromIDListA
SHHelpShortcuts_RunDLLA
SHQueryRecycleBinW
SheGetCurDrive

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE