94b5f785f7ed7c14fbb20d20830412d2_JaffaCakes118 | Triage

Sharing

General

Target

94b5f785f7ed7c14fbb20d20830412d2_JaffaCakes118
Size

66KB
MD5

94b5f785f7ed7c14fbb20d20830412d2
SHA1

e33e49c2e04a672146360cc1c5e75e437174afb5
SHA256

79c9b2846b32ea7cd629e9b0eabc7920ed1e1dcac4f203c6d0504f34a513a52d
SHA512

69c671e10e576eedc74bd30681760a971d7a34c702cb6ff45b058a13a382d2d0ee452d44c440d4e62f197850cd111d03d2d434a8953724831bbe8177242f8e1d
SSDEEP

768:O6j2pX4/k+V81EWE962KSOvLCvr5Sy4ro1Q39HnDSUq6GouY5gXClXZOPd879cUQ:tBKsFS3kS39Hn+UwovgXN8x/e3ac

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94b5f785f7ed7c14fbb20d20830412d2_JaffaCakes118

Files

94b5f785f7ed7c14fbb20d20830412d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

533a76b64d974e695fd6b9efa3d64ff2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapQueryInformation
BaseFlushAppcompatCache
HeapUnlock
GetSystemWindowsDirectoryA
SetTapePosition
lstrcmpiW
ReadFileEx
BaseInitAppcompatCacheSupport
InterlockedPopEntrySList
ExpandEnvironmentStringsA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE