5bd6b85fef1d4c0d1cc286d661aa7461_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5bd6b85fef1d4c0d1cc286d661aa7461_JaffaCakes118
Size

107KB
MD5

5bd6b85fef1d4c0d1cc286d661aa7461
SHA1

2e09e6131d3c93174ac05370e34a283c43634350
SHA256

58eed71daf534017beb0187f2f5aa4d236e6309174f2ea86fb61b26ad9b48b62
SHA512

406b352a7ca6943958149acf6777017d343af8652e43f879131d088792cd98036873e4f2c26f12a8fedd9977aad8e5140dac96dc65f493a24c22ec9fa49a33b7
SSDEEP

3072:jHVON/u9Oy8OCgNNke33hWxfOHs2quGf9:jW/aO4NRm+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bd6b85fef1d4c0d1cc286d661aa7461_JaffaCakes118

Files

5bd6b85fef1d4c0d1cc286d661aa7461_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d69372f0d0bb38942037c587c253cec9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVolumeNameForVolumeMountPointA
CreateFileMappingA
CreateWaitableTimerW
GetComputerNameExW
DebugActiveProcessStop
GetConsoleCP
LZClose
GetModuleHandleA
CreateProcessInternalA
GetPrivateProfileIntA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 51KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE