b3c7a08b8024a990db57bdb9897f8b64_JaffaCakes118 | Triage

Sharing

General

Target

b3c7a08b8024a990db57bdb9897f8b64_JaffaCakes118
Size

76KB
MD5

b3c7a08b8024a990db57bdb9897f8b64
SHA1

53d5af87ff7eefa3803cfa637ebbe1193bee5e69
SHA256

5dbbbb15c049ed9ed6f1cef8121a2e3703a01be4d7c0b217f9ee90052532cce3
SHA512

8b41c693920130dc1e9cbf68d809db87f3e7c6942cf760375c7859733924b177d304e1eee6849836dac0639faa3cd804c1ccc5df45fd0fa976d58c83cf83318d
SSDEEP

1536:b8rU9oi8dItQVbElZHRJaVpQA5XRHApjVrs2ryrd1vUQuq6:ggGi8dItaEjRJw5AHs2qo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3c7a08b8024a990db57bdb9897f8b64_JaffaCakes118

Files

b3c7a08b8024a990db57bdb9897f8b64_JaffaCakes118
.exe windows:4 windows x86 arch:x86

363a548004ce412b6aa75d10b57bec9f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VerSetConditionMask
lstrcpyn
CloseProfileUserMapping
GetStartupInfoA
RemoveLocalAlternateComputerNameW
GetProfileIntW
VirtualProtect
IsBadHugeReadPtr
MultiByteToWideChar
DeleteTimerQueueEx

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE