aeca9fc5214c30dadbe8387aa0ffbd13_JaffaCakes118 | Triage

Sharing

General

Target

aeca9fc5214c30dadbe8387aa0ffbd13_JaffaCakes118
Size

280KB
MD5

aeca9fc5214c30dadbe8387aa0ffbd13
SHA1

372c0dfa538a92e105ede1c999b35d45fc93c8f0
SHA256

16f726cd293856728f0ea41e48bf7679cc6713a4f4bcf507fcd58ccef9bddc31
SHA512

2132b170884d5b47851f776be2ce664806b371257bae271131fc2cf3011677f64c697544ae1413add18243dce12656a914bf263b98d00d4a7aebb198f9b1be2a
SSDEEP

6144:z5v/hAUk2i+inCq1orveoLMygVqlS8fD19ixZ/DDkDHyOeRZ00sZI:z5v/yUiLCq1oK4MyzS+D1alkDHyJO0KI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aeca9fc5214c30dadbe8387aa0ffbd13_JaffaCakes118

Files

aeca9fc5214c30dadbe8387aa0ffbd13_JaffaCakes118
.exe windows:4 windows x86 arch:x86

262a92b4d122c9558423d0a9e08dc634

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

memcpy
memcmp

kernel32

CreateFileA
CreateDirectoryA
CreateFileMappingA
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
GetProcAddress
LoadLibraryA
GetEnvironmentVariableA
GetMailslotInfo
GetFileSize
GetConsoleMode
FreeLibrary
DeleteFileA

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 228KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 870B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ