961d33607e7aa8c127db6dcf7b762f7e_JaffaCakes118 | Triage

Sharing

General

Target

961d33607e7aa8c127db6dcf7b762f7e_JaffaCakes118
Size

56KB
MD5

961d33607e7aa8c127db6dcf7b762f7e
SHA1

a78ddf40903914a40ed7811a2a23cc74c385498f
SHA256

fb9d074b9cc409733af048537992ce7545e9337145bc66e16aa7941bffba6d66
SHA512

97e94a2d39bd534cf6ac3901e52ecd8b0926680d90caa5f210842efd1c75031ee426bd90d57fd1f9b76a561eb889915c674589081f9a8c38dedfbdb17a8a2dba
SSDEEP

1536:xGVhJu2VC1cPE52r5sJXo5JaSEnZEBV5Uva0xHgQS:xGv4yTPEorkY5J1t5UC06

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
961d33607e7aa8c127db6dcf7b762f7e_JaffaCakes118

Files

961d33607e7aa8c127db6dcf7b762f7e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0338dd7e0dd26fcf2c90176edb825bdf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameExW
GetStringTypeA
VirtualProtectEx
LoadLibraryExA
FindVolumeClose
InitAtomTable
DeleteCriticalSection
NlsResetProcessLocale
DelayLoadFailureHook
GetNumaHighestNodeNumber
CreateProcessW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE