5b0a7a578129d83452b32b2714005b43_JaffaCakes118 | Triage

Sharing

General

Target

5b0a7a578129d83452b32b2714005b43_JaffaCakes118
Size

63KB
MD5

5b0a7a578129d83452b32b2714005b43
SHA1

846ed2d58c7c55a4e111f9fe02d31bdcb2f95a82
SHA256

873de8288f79068d037fc75a5d68ccd3c007b4b3329983b6e7aaa5b8d95c2318
SHA512

2b19551f4064a90dedf02b91e53f3776f593d827cc2286b1e7c1082e6d71f278be35a97dbe5055c537f82e84538204a8017d8ec24b856e3e0931c772e8e8d223
SSDEEP

1536:pAG2g8IF6cup/tevL27RpLN91gSm61DEQthD:pX2g8IF1MFLTX12jGD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b0a7a578129d83452b32b2714005b43_JaffaCakes118

Files

5b0a7a578129d83452b32b2714005b43_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9911d986ae6730328342ab90dc95a4dc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetOverlappedResult
lstrcmpW
RequestDeviceWakeup
SuspendThread
LCMapStringA
ReleaseMutex
GetExpandedNameA
SetEndOfFile
ReadConsoleInputA
GetSystemWow64DirectoryW
VerSetConditionMask

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE