c217c0bc38ddd8517d7215e2067123e8_JaffaCakes118 | Triage

Sharing

General

Target

c217c0bc38ddd8517d7215e2067123e8_JaffaCakes118
Size

62KB
MD5

c217c0bc38ddd8517d7215e2067123e8
SHA1

194f90c7c7ed63ae76b82938a213c42d212be95d
SHA256

172c24e8960348a01f0198be6141c7cae3a214c232405d2474ee4c27fec64604
SHA512

1be8aae2765d74b2d1fc0e7a55beb457b32829a28376f73a28d5df79e6c5ade96df0f8b990181b2a886efdb8aa80a8890c09e22d20b83dbb42515983824c5138
SSDEEP

1536:Noskk/PxPlnYQhv+6kwJRq9UilAh3+EU91T3kGwDZTZyIp:DkINln7dlJRsUi43+Eq1zwv5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c217c0bc38ddd8517d7215e2067123e8_JaffaCakes118

Files

c217c0bc38ddd8517d7215e2067123e8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fbe36c3799f54cdc47b3646a7ece52fc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleFontInfo
BuildCommDCBA
VirtualBufferExceptionHandler
DeleteVolumeMountPointW
GetProcessAffinityMask
IsBadHugeReadPtr
GetFirmwareEnvironmentVariableA
GetConsoleDisplayMode
Sleep
CallNamedPipeA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE