cfa5645be926899e01444b096162c2f2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cfa5645be926899e01444b096162c2f2_JaffaCakes118
Size

91KB
MD5

cfa5645be926899e01444b096162c2f2
SHA1

b01bff3d4a27b2230fec6eba04c31cac5d7543b6
SHA256

57ac3cce075af7dec9931dd6f63774027880cc95f4412b5fdc149a62dc6787a3
SHA512

b08eb9b8460f5aa61546e85eb17a2093f3c70ae667f8c30bef28eaab45c863f7f2f4d6c0f214a1ee84999b90345308ae3444731ab8aacf56b9f5abab1a6de478
SSDEEP

1536:lXgkRbuHNF0Lndxb4vy4PeXfcRXTVeK7kFBvtrj1sVehJxP2QKpi7K:lwfenjMy3cRDfyBlrxueh0i7K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfa5645be926899e01444b096162c2f2_JaffaCakes118

Files

cfa5645be926899e01444b096162c2f2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e42643146a55fd7ef4fd722e1f0c31c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntdll

ZwReleaseSemaphore
ZwCreateSemaphore
ZwSetEvent

kernel32

Sleep
SwitchToThread
VirtualAllocEx
GetStdHandle
InterlockedDecrement
CloseHandle

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ