a8ebe201fcb39d6b11aade7732be6a0a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a8ebe201fcb39d6b11aade7732be6a0a_JaffaCakes118
Size

67KB
MD5

a8ebe201fcb39d6b11aade7732be6a0a
SHA1

8b14ab5695fdee88e92335b2a47d2f7a15077311
SHA256

5e11af1d36954872fab044ed834e3d7390b31d03692b50c31c3f2ce2f99e13c6
SHA512

5f16c58b53f7dbb24f48e3da4698fffae95f78f95385a0140329c23972d61b30b5553b4f7699ae41b9614d654210e3199d26bf825547b091cdba40af5b9ce7c5
SSDEEP

1536:Q1+ByObHZXBdGwCzE4AYVoglPfW7+7mAz/85oPd+QqgK:2aBQoAfWUmA45cwOK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8ebe201fcb39d6b11aade7732be6a0a_JaffaCakes118

Files

a8ebe201fcb39d6b11aade7732be6a0a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e0813048bac187ada996e8bb3c4ffbea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DisconnectNamedPipe
EnumResourceLanguagesA
FindVolumeClose
GetThreadTimes
AddAtomW
ReadConsoleW
GetVolumePathNameW
_lopen
SetHandleCount
EnumDateFormatsExA
FindClose
QueueUserWorkItem

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 52KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE