723348ca369a2ce4e5dc28265026be13_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

723348ca369a2ce4e5dc28265026be13_JaffaCakes118
Size

318KB
MD5

723348ca369a2ce4e5dc28265026be13
SHA1

9ae073af869dc96bbaf98b44a52f453b74a44ca2
SHA256

05da3081d118c46c74d8c2d546c43577c227ca50c3c579dff587ced7e9fb523b
SHA512

8f0482baedc758406e85c3477dffff5c53d67f61a0b7b76856dc624f97c274eb3b21a58f77c59c9f612219b20910483c7aeb8c2932f5a2a1f5fa1294b2de0f76
SSDEEP

6144:BTa0zV22jgt3MAk2O9hrnFlC9Fuj561MFNHoTgt280Y7fwnRXEfC6/59BuDDCb1j:RjVWMA9E2uj561N1XEftfB/j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
723348ca369a2ce4e5dc28265026be13_JaffaCakes118

Files

723348ca369a2ce4e5dc28265026be13_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ff2d3e0df797a322491897d16d031460

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadDirectoryChangesW
ReadConsoleW

ntdll

RtlPopFrame
RtlFindClearRuns

user32

PtInRect

activeds

ADsBuildEnumerator

crypt32

CertGetCRLFromStore

rasapi32

RasScriptReceive
RasEnumConnectionsW

oleaut32

VarCyFromUI4

netapi32

NetWkstaGetInfo

shlwapi

PathParseIconLocationW

iphlpapi

SetIpForwardEntry

msdmo

DMOGetName

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 846B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ