946b76e404b97e97b84bad95815e6d93_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

946b76e404b97e97b84bad95815e6d93_JaffaCakes118
Size

224KB
MD5

946b76e404b97e97b84bad95815e6d93
SHA1

f8ac502f13688b22a021962c50314f5eee322e95
SHA256

5941f4729f688794b475bb23a3ff6d33af3a5951155080cf6ce9ca09f0236d96
SHA512

dc1440cea2437ebb4efced8bb7cfb70fb4d006bc67c6fc7c5367c0210731c75fb20c1ac5f8e99831b7c8659dd2c4ffd3083ebcd1eacf96157cf72fbadbf263c7
SSDEEP

3072:LiZMHbuCXPO3Su+OicovtDD2m3AfKrPpIO1n6p6nNLTiRh3mFFFFVN78fL:L37aZiBDazfOPpIOh6oNLTiRhc38f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
946b76e404b97e97b84bad95815e6d93_JaffaCakes118

Files

946b76e404b97e97b84bad95815e6d93_JaffaCakes118
.exe windows:4 windows x86 arch:x86

897916d09b0590794776057f674cea49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleMode
DeviceIoControl
GetConsoleAliasExesLengthW
MultiByteToWideChar
WriteConsoleOutputCharacterA
GetCommandLineA
VirtualAlloc
GetCommandLineA
SetComputerNameExA
HeapAlloc
SetCommMask
GetVolumePathNameA
GetSystemRegistryQuota
InterlockedExchange
Toolhelp32ReadProcessMemory
GetThreadTimes
GetLogicalDrives
FlushViewOfFile
ClearCommError
GetPrivateProfileSectionNamesW
ReleaseMutex
SetFilePointer
HeapFree
SetFileAttributesA
GetCommState
EnumSystemCodePagesA
EnumTimeFormatsA
ClearCommBreak
DisconnectNamedPipe

ws2_32

recv

Exports

Exports

Slqhvsfqqu
AddGdbtojd
Lmjjyowd
Yhbghyv
IsBvknhmopdoq
Vrffnpiwn

Sections

.itext
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 208KB - Virtual size: 852KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ