5dd46dcbf089adb65841555ba58244cc_JaffaCakes118 | Triage

Sharing

General

Target

5dd46dcbf089adb65841555ba58244cc_JaffaCakes118
Size

83KB
MD5

5dd46dcbf089adb65841555ba58244cc
SHA1

a3f9482284cdd03c26322a15ff5a784ccc9dc161
SHA256

21084a597a380fb86629b0b4ea180e2c3cc2fdba5e376ad61bd6920e69e18b6e
SHA512

493afe8c52eac8d20585f6053e8565a60b069167373dc129d200c76f9468bbfaaf273d31c5fad528321007c02b26a168972eab09c3e988607caef458e2487b34
SSDEEP

1536:icccctACSIs0IIOeeh2IVw7j0IBPSFXniwe98O/OjhlHGq1jEErxTWDTMqhGKYIy:4ACrs0+1hyLPShK9LOvHNjBkMqhGKZTE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5dd46dcbf089adb65841555ba58244cc_JaffaCakes118

Files

5dd46dcbf089adb65841555ba58244cc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

450a07c4d4fa85c6d57f509e8ab17e8e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenJobObjectA
InterlockedPopEntrySList
RegisterWaitForSingleObjectEx
DosDateTimeToFileTime
DeleteVolumeMountPointW
ReadProcessMemory
CancelIo
FindFirstVolumeMountPointW
GetAtomNameW
QueryMemoryResourceNotification

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zrdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE