b4badb1de98560ea2cd3245245caffb9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b4badb1de98560ea2cd3245245caffb9_JaffaCakes118
Size

451KB
MD5

b4badb1de98560ea2cd3245245caffb9
SHA1

86a447a3b9c43fdff8cdbd94de23dbe2a1971985
SHA256

414685d66c0cf7bebd4d90bbc35255007f8dc88263134a428a20048cc99a9aae
SHA512

8fbb9e272ed5ee729c90729d7bfbe8a7f2fed455c952321a921518dacd79f28519ce2252a62b610b0d1cf1baffccb2b4debff3fc75fe5aa193ca1109cdcf5b43
SSDEEP

12288:tRD2OPRrIsePyItePKuUuaLN4CEcx028dwVqSqVJixoOK9a:tNZneFtePKuULBKcB8wCVJiKOK9a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4badb1de98560ea2cd3245245caffb9_JaffaCakes118

Files

b4badb1de98560ea2cd3245245caffb9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e9ccc702b12f0628c841c322ff3be475

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtAdjustGroupsToken
NtAllocateVirtualMemory

kernel32

Sleep

rpcrt4

NdrOleAllocate
CStdStubBuffer_Disconnect
NdrDllGetClassObject
NdrCStdStubBuffer_Release
NdrOleFree
NdrDllCanUnloadNow
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 297KB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE