8d7a611c18c505f24fbee0c98cecdb82_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d7a611c18c505f24fbee0c98cecdb82_JaffaCakes118
Size

100KB
MD5

8d7a611c18c505f24fbee0c98cecdb82
SHA1

ebd5a93071a8673b2044493bb4fc8af613203402
SHA256

3ae93d62f4145295b160fcbe3fd5739070f0c99e2fb561df65f8a91e6315d4c8
SHA512

8adff1a09dc1dfcabe10d26429b1a4e029838c76c066cbb58e28b84df3a591078f66a27163598ac2fa82d3edae56dc390cc3d7f85f828db38f6b02df67cd1b38
SSDEEP

3072:YZ+HvuXir+Z/T9UTDjp9NZV+7AmqJO7Gz:zH3r+deTPtm7c87

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d7a611c18c505f24fbee0c98cecdb82_JaffaCakes118

Files

8d7a611c18c505f24fbee0c98cecdb82_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c30ed3ea2a6c58722e357a15406ae9c2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
ExitProcess
GetStartupInfoA
GetConsoleMode
_lclose
SetVolumeMountPointA
QueueUserWorkItem
EnumSystemLocalesA
GetDefaultCommConfigW
GetNumberFormatW
SetDefaultCommConfigW
ContinueDebugEvent
DeleteFiber
FindNextFileW
GetConsoleFontSize
LoadLibraryExA
FindNextVolumeW
GetConsoleAliasExesA
CreateProcessInternalA
VirtualAlloc
EnumUILanguagesA
SetConsoleKeyShortcuts

Sections

.data
Size: 8KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ