c13f33c5b0ca6c8c1179314c50d48327_JaffaCakes118 | Triage

Sharing

General

Target

c13f33c5b0ca6c8c1179314c50d48327_JaffaCakes118
Size

107KB
MD5

c13f33c5b0ca6c8c1179314c50d48327
SHA1

e0e75bd9afde95ce4f9e03075af053411cce6104
SHA256

9aaf454d7efc93fb4497ee6c35a538b7a1f6802c673c29bef10d73892c6d2e9d
SHA512

1cc2d3f01a46940dc01f6c228f721aaffe44618dc9a2bddfbbffca37d64a5f1547d694e45d5c72c41fadf1c6adb9a58cd702acb42ddf2cd6c1a0cd9f3c669275
SSDEEP

3072:10VMoIKDj0c0CJBecUYzlzrMvHU+BIuQH:qBGdY5IDBK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c13f33c5b0ca6c8c1179314c50d48327_JaffaCakes118

Files

c13f33c5b0ca6c8c1179314c50d48327_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aa7414d5d30e7eabfcc78f8dbfee2491

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CreateActCtxW
TrimVirtualBuffer
SetComputerNameW
LocalSize
SetConsoleFont
GetLocaleInfoW
GetConsoleCommandHistoryA
OpenEventA
GetConsoleNlsMode
GetOEMCP
FindFirstFileA
CreateHardLinkA
GetLastError
GetShortPathNameA
GetProcAddress
ExpandEnvironmentStringsA
LoadLibraryA

Sections

.text
Size: 82KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_MEM_READ

.itext
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE