4db04be99e086c9e900408032a8ff320_JaffaCakes118 | Triage

Sharing

General

Target

4db04be99e086c9e900408032a8ff320_JaffaCakes118
Size

1.2MB
MD5

4db04be99e086c9e900408032a8ff320
SHA1

c11fd112f65387ed321995e9dff4be648654d585
SHA256

50bf98c9a85bfa379c856dffef58be08f611629337678e1c7ee5707558d3ba3d
SHA512

20ab6f51030cc0433479c3b9db5df4f94373f80d7db0e1235dbef2e68e69f9fd984573706a2c6ea00d74cc000bcc0f401b85ea2b1c8d8a3652c9af85f07ed166
SSDEEP

24576:9j8+cC/jlWT1qOhNfxBogmGqfc0Fb7qBbzEYAtqI:P7QT13XxBogIckw3E7qI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4db04be99e086c9e900408032a8ff320_JaffaCakes118

Files

4db04be99e086c9e900408032a8ff320_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a21e089e357fc64bac1aef7b2d8f9a71

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
VirtualProtectEx
GetModuleHandleA
ExitProcess
SetConsoleScreenBufferSize
GetStartupInfoA
GetModuleFileNameA

advapi32

GetTokenInformation
NotifyChangeEventLog

Exports

Exports

Dsyjgyp
SetYxcmofntdr
Ahacbdplg
Gtdhqtxutjs

Sections

.text
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ldata2
Size: 12KB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enull
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ