b127db2e69c1b552f2a3f90b77c15bac_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b127db2e69c1b552f2a3f90b77c15bac_JaffaCakes118
Size

114KB
MD5

b127db2e69c1b552f2a3f90b77c15bac
SHA1

73b832bf84c82f607604a9fa41506fd377f26ce0
SHA256

e87236d20fba33869db4f2345eaba2069bf3d85354f86b77674392f3fd1d2da0
SHA512

5a6445089725afede755fb03ea7b7ff1bdaf2e19a040b04c0bd3c623289e406059e06543a3fbfa09843c6ccff72c54dfb10ddd56df6059e8818146ae4c0e2498
SSDEEP

1536:bAcoIqOPfcUCFwXTJCeM3lorMO7l0TcL8DmcPn4agphZDP26QmvPRWE/sAVNG:DodOHDnCeMrMl0TcwjP4Jprj2iPLdG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b127db2e69c1b552f2a3f90b77c15bac_JaffaCakes118

Files

b127db2e69c1b552f2a3f90b77c15bac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6f539637b27a04898c15b8e41f40c314

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadConsoleInputA
OpenWaitableTimerW

ntdll

RtlDestroyAtomTable
RtlCopyOutOfProcessMemoryStreamTo
RtlDosApplyFileIsolationRedirection_Ustr
RtlEnumerateGenericTable

ole32

CoDisableCallCancellation

gdi32

PolyPolygon
StartFormPage

rasapi32

RasConnectionNotificationW

shlwapi

SHRegEnumUSValueW

netapi32

NetRemoteTOD

tapi32

lineGetAgentInfo

Exports

Exports

CpttnNwVzB5uujkbG
StAVR86tkJhwFfzH

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE