c0481c52ff7acd6dde6be5e5a2a9c422_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c0481c52ff7acd6dde6be5e5a2a9c422_JaffaCakes118
Size

83KB
MD5

c0481c52ff7acd6dde6be5e5a2a9c422
SHA1

ac638fe036c5498e9554d2f2acb793b8d5f3b9b1
SHA256

28c16c1f6ba477e14c555418fed14881fb99c7dc9ac747cf1921312be03ab1e9
SHA512

7fc4d2cab6f81de4426a468f4f39e66a96349afbf158ca562f61708085dcfbed77f58f8ed1c533c2a83d6731d270800e812fa7c0301c26db858245faf0dcdd09
SSDEEP

1536:aFirPn9Hjb6GMhsy0pmwjEErxTWDTMqhGKYIZTET8s0C98:h9b6VhKpmwjBkMqhGKZTbsX8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0481c52ff7acd6dde6be5e5a2a9c422_JaffaCakes118

Files

c0481c52ff7acd6dde6be5e5a2a9c422_JaffaCakes118
.exe windows:4 windows x86 arch:x86

91c38fff6dc10bb926997c72e3cb8900

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadConsoleW
lstrcmp
WriteProcessMemory
GetOEMCP
EnumResourceNamesW
LZOpenFileA
GetEnvironmentStringsW
GlobalCompact
IsValidLocale
GetProcAddress
Module32NextW
FindNextVolumeA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zrdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE