8a542d919ddd6bbf35865e5234bf81c3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a542d919ddd6bbf35865e5234bf81c3_JaffaCakes118
Size

62KB
MD5

8a542d919ddd6bbf35865e5234bf81c3
SHA1

af3e07d166bece557bcc1dca00ff25ca8d7c5277
SHA256

9d4ece3f3dd00e5705d18f54648de05ed53ab94fdd7dc86749e1d4f0b4a99b00
SHA512

f0aafac427215132edca6044a5bbc80e67a643107ce227a499a46712e3357fc6c52e5356a07b398aa7c01252d79b353813d68cfec7fd94f423cd449dfe791c28
SSDEEP

1536:u6Hzn5lAaFOHZnPcGJhXtzzeu4y91+/8Zxlw67rapm1M:hTwBPjv9PTv9k/+jraIM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a542d919ddd6bbf35865e5234bf81c3_JaffaCakes118

Files

8a542d919ddd6bbf35865e5234bf81c3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ebe02b5d06f97bf355d94a93165fd6ca

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentStrings
SearchPathW
BasepCheckWinSaferRestrictions
TransactNamedPipe
_lcreat
IsValidLocale
FindActCtxSectionGuid
SetFileAttributesW
SetConsoleCP
DeleteAtom
SetFirmwareEnvironmentVariableA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE