8d06aef023b8c7763067e4b479d3633e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d06aef023b8c7763067e4b479d3633e_JaffaCakes118
Size

87KB
MD5

8d06aef023b8c7763067e4b479d3633e
SHA1

85596985c4e00c179fdebab820e4408d900f3e06
SHA256

d40d2ed7024dadee52906bc068af7b666da54dd9be4ed2f1d129bafa443e8cbb
SHA512

95231a0d4674f2acb87b942b4f6eb386ce128061beb1157591b75f7a3058e51e5388dbac8f0e84dfc150e834c450ba9750b39e00c8520e02904f5355b99bfd20
SSDEEP

1536:Ac3ZcX6OVCeeKFHufW/yj1JbtCPG1dSs+H4cLYpjVrs2ryrd1vUQuqij27g6eJv:Ac23CefHLigASs+jYHs2qYj27/yv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d06aef023b8c7763067e4b479d3633e_JaffaCakes118

Files

8d06aef023b8c7763067e4b479d3633e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

172505fa7e6d5c3f884dd3983d567a1f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FoldStringW
ConvertFiberToThread
RtlMoveMemory
WriteConsoleOutputAttribute
LocalUnlock
AssignProcessToJobObject
LocalReAlloc
WTSGetActiveConsoleSessionId
GetConsoleProcessList
GetNamedPipeHandleStateW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE