5a3f357986a84c51713e2a7c7664dc9b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5a3f357986a84c51713e2a7c7664dc9b_JaffaCakes118
Size

63KB
MD5

5a3f357986a84c51713e2a7c7664dc9b
SHA1

e38ee25d8d75e23fcab2b40dc2d3df6aa6b099be
SHA256

04c40952b79e81ac732f6f98a412e1627b278ed6c80dc82c595d6ea99bf3cc82
SHA512

001ab57278305e97e999e2979f194b41bd0161cf419ca135fd39cd3b0221d682fda21b77c9271771471d3551616919d75d7d62ebc1fd12366319ce3947591004
SSDEEP

1536:ZZ9lSfvvLF7oR3z8mrqcA07gRBzv/bZTGw9/Tn:lcLFcRoGuRp7ZHTn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a3f357986a84c51713e2a7c7664dc9b_JaffaCakes118

Files

5a3f357986a84c51713e2a7c7664dc9b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

37e7fb09d8903b8610ba9808429adc02

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnumUILanguagesA
InitializeSListHead
FindVolumeMountPointClose
IsWow64Process
SetComPlusPackageInstallStatus
GetVolumePathNamesForVolumeNameW
CreateJobObjectA
FatalExit
QueryWin31IniFilesMappedToRegistry

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE