c0e51608d8a844cd0351ba9168878c46_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c0e51608d8a844cd0351ba9168878c46_JaffaCakes118
Size

438KB
MD5

c0e51608d8a844cd0351ba9168878c46
SHA1

3b45437384ea2c049975a2bf1f2743b36a4dec6f
SHA256

003547da7494486de057d4cce10bc681a6ef07cde2b92543ce8a788f1136a974
SHA512

cf112ec4564f57bde22fcdbf493e1a2b65fa2bbfbd5967f65f6d857f35636b36b7c22dd4fddcafde6c90f26fe22b96321ab4faabf8fb13dc7b7831c120d79f69
SSDEEP

12288:2udW7bNvI6R5vgPfvNYWB9dnKkG45malMo7ru:7CIK1gPfvNYWB9dlG45b2z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0e51608d8a844cd0351ba9168878c46_JaffaCakes118

Files

c0e51608d8a844cd0351ba9168878c46_JaffaCakes118
.exe windows:5 windows x86 arch:x86

428a3655bb49e5839cbd30816912ed95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

VirtualProtect
GetModuleHandleA
GetProcAddress

advapi32

FreeSid

gdi32

GetDeviceCaps

user32

GetDC

comctl32

ord17

version

VerQueryValueA

Sections

.text
Size: 433KB - Virtual size: 564KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 781B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

linghun
Size: 62B - Virtual size: 62B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE