5ed78197dc0b14d149c93261cbde468a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ed78197dc0b14d149c93261cbde468a_JaffaCakes118
Size

66KB
MD5

5ed78197dc0b14d149c93261cbde468a
SHA1

91bfb2ceb143badd8fb49d3d68c2ef43f07cd269
SHA256

145c2a4d7a883f517bcb0b7f2e98f7bf78be1c99a8ed26542d76100cdc4a58ec
SHA512

2b0687328d52c930c44c553b14e842e20aab4751f4ff2537a64a13e44cc2be15fe6d01ffeab4cd59d48241901aea001d5d102784009b3b8eddf13d395d8f3252
SSDEEP

1536:6/r6Yke1nFY97t/ZYc6X8dv5d7nrijknO4ZXADimijkcV1850DBoZ9GnXvkWcU4m:6j6Yk4nm97t/Zl6k7nrIiKi3P18iDCZG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ed78197dc0b14d149c93261cbde468a_JaffaCakes118

Files

5ed78197dc0b14d149c93261cbde468a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1b5232eaec91d4015651a25137475043

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Module32Next
GetLongPathNameW
CreatePipe
MoveFileWithProgressA
HeapCreate
GetPrivateProfileSectionW
SetProcessAffinityMask
lstrcmp
FindClose
DisconnectNamedPipe
GetProfileSectionA
LZCopy

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE