96fbd495cc412257e0a27e16e176584b_JaffaCakes118 | Triage

Sharing

General

Target

96fbd495cc412257e0a27e16e176584b_JaffaCakes118
Size

76KB
MD5

96fbd495cc412257e0a27e16e176584b
SHA1

72bfc508d2a20d569b5b697e50308f7de40b8918
SHA256

e7683e2ea94b38a64e5f6b29dc25f90456f1b2b22e58698bdedac30855201f8d
SHA512

84211f9f6181945cb4edd69ddbf38841a78f23d63e86bec0a9d88d924c6ee742bf2eee05e025f2f22662ab1c5f0d6bf2800c6f8c5e529b464adb46391792f8b4
SSDEEP

1536:vqTgFGvF/xTD21zyWTMUIIE0OcpZUKKpjVrs2ryrd1vUQuq6:iTgk9/OylzLUcJHs2qo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96fbd495cc412257e0a27e16e176584b_JaffaCakes118

Files

96fbd495cc412257e0a27e16e176584b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ab565e8402bd504330600303d7734ed6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCommandHistoryA
WriteConsoleA
ReadDirectoryChangesW
FindNextVolumeMountPointA
GlobalGetAtomNameA
CancelIo
GetTempFileNameA
PeekConsoleInputA
LCMapStringA
WriteProcessMemory
LZCopy

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE