5ff0ab47f131594582779229c4d13aa2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ff0ab47f131594582779229c4d13aa2_JaffaCakes118
Size

26KB
MD5

5ff0ab47f131594582779229c4d13aa2
SHA1

023074052bcc2af0267fc15307dc995c0bb69f89
SHA256

ee520c9bdcd6a6866812a14a267a38027d184b830ec3015381498146adc89e8e
SHA512

15e40cd6e45fdb6c0dc1241e6db28f14f4f2b8363cba15f033903b1ee57855cb952f84842f1f422ac7a2ddc15f9394b041eff0bcb270786a9886d26b10ee1258
SSDEEP

384:1Ku4RbLXMX2d3NWuYntfmkUnUXp/kSZwGDNdtG:16R3XVvWuYntekUUXp/kywSN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ff0ab47f131594582779229c4d13aa2_JaffaCakes118

Files

5ff0ab47f131594582779229c4d13aa2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

318aa39e8e4cef8db96af39b8dabc232

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
VirtualProtect
LoadLibraryA
GetProcAddress

advapi32

AreAllAccessesGranted
AddUsersToEncryptedFile

shlwapi

StrStrIA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ