af515918a6850e776947014aa3e2b03a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af515918a6850e776947014aa3e2b03a_JaffaCakes118
Size

1.0MB
MD5

af515918a6850e776947014aa3e2b03a
SHA1

495573336f763c757a01f13f99066ecb285eea4f
SHA256

b2e0843b026b075e51101f3a7995099db5d1285f9b6865bbffb656a2a9183fb0
SHA512

17d6f907ca1a4245f07715b53e7bf9166922500fc7e6932d88afbfafcfc4d9e481abef2ce36eda7ff53f4a9546844d5ab8c91be9e95a217d013d02c8735515f3
SSDEEP

24576:ZgJ6kWyQlHzv75fFL6IlNP0bisjonFHTaXcbBRTGqnmg:Zq60QlT7HL6kcxSzaXcbXKq5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af515918a6850e776947014aa3e2b03a_JaffaCakes118

Files

af515918a6850e776947014aa3e2b03a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ba8d5732b895df2b9b79cfa91c4ff718

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_ctype
_eof
_chkesp
_except_handler2
_CIacos

advapi32

CloseEventLog
CryptGetHashParam
AdjustTokenGroups
CryptSetHashParam
DeleteAce
DuplicateToken

kernel32

ExitProcess
TerminateThread
WinExec

Sections

.text
Size: 259KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 154KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 520KB - Virtual size: 520KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE