5aaa235225d6d70439cc8e7d8b7f02b2_JaffaCakes118 | Triage

Sharing

General

Target

5aaa235225d6d70439cc8e7d8b7f02b2_JaffaCakes118
Size

1.1MB
MD5

5aaa235225d6d70439cc8e7d8b7f02b2
SHA1

b1947757ca322f46903ea1ad6bf181775b00ffaa
SHA256

419d16e57f634ab305383b779f95848bdf02604d3afbb827079d05d43ef4e055
SHA512

3b68481517e938cbaa2d7e95291b43fbe92d6ed212d86924bbe6fe12dcea9dc00a3712c90fa31b929b563695672bc5e139fcec8decb48193dbb2e2155c38ecf8
SSDEEP

24576:4qU4cRLDXIvXFdmo0bisjonFHTNcbBRTS/qId4T9U:4FvDS1MtxSzNcbXW/qIST

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5aaa235225d6d70439cc8e7d8b7f02b2_JaffaCakes118

Files

5aaa235225d6d70439cc8e7d8b7f02b2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1c2d42a4e533f3c86f1f4597355c880c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenGroups
CloseEventLog
CryptGetHashParam
CryptSetHashParam
DeleteAce
DuplicateToken

kernel32

WinExec
ExitProcess
TerminateThread

msvcrt

_chkesp
_ctype
_eof
_except_handler2
_CIacos

Sections

.text
Size: 253KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 708KB - Virtual size: 708KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE