aba71138e288311b8e820fbbedce6ecf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aba71138e288311b8e820fbbedce6ecf_JaffaCakes118
Size

265KB
MD5

aba71138e288311b8e820fbbedce6ecf
SHA1

3aede655ec328ddc770e4c73a3c74ba71368fd37
SHA256

3f7690c269c0baa647607375a51ede71a7701b62ebd2b5cd79323a2a73c53a5c
SHA512

96505be3ab3b55d9d025d86b11f7571c5545a8a1bfeb651a36319a4a2d8a5b935d9fa89c5005fa1f6393170d17c3cae9b0588e982e3fd72bd1bed3951a5efd98
SSDEEP

6144:gYuvxm+zIOWsNTaPGAYfp4GgE+tI+hlgLM:gZx/EPB+b+tI+hJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aba71138e288311b8e820fbbedce6ecf_JaffaCakes118

Files

aba71138e288311b8e820fbbedce6ecf_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

netsh.pdb

Exports

Exports

ConvertGuidToString
ConvertStringToGuid
DisplayMessageM
DisplayMessageToConsole
FreeQuotedString
FreeString
GenericMonitor
GetEnumString
GetHostMachineInfo
InitializeConsole
MakeQuotedString
MakeString
MatchCmdLine
MatchEnumTag
MatchTagsInCmdLine
MatchToken
NsGetFriendlyNameFromIfName
NsGetIfNameFromFriendlyName
PreprocessCommand
PrintError
PrintEventLog
PrintMessage
PrintMessageFromModule
RefreshConsole
RegisterContext
RegisterHelper

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 33KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lif
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE