d2e0ca83c471779fad3c41bc5e9a9789_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2e0ca83c471779fad3c41bc5e9a9789_JaffaCakes118
Size

1.1MB
MD5

d2e0ca83c471779fad3c41bc5e9a9789
SHA1

40b63464e5bc5a3321043ff309d312cda3520af7
SHA256

e4f8ecd7a32cdbcbeef7f82abb64bddc413dfe723c03d6c21b921bf52737ccd2
SHA512

19bff9983bb6dfa2c2c5c4996b0d2f11d87647a204faa0b215fb8bd572ad5381da37f40237126bd67db15089949fd69d5865db1eeb325a17af9711f41b23314c
SSDEEP

24576:F1J5Bcp4KQqgtp0bisjonFHTaXcbBRTGqnGdZT9UMk:FIpv1xSzaXcbXKqGrT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2e0ca83c471779fad3c41bc5e9a9789_JaffaCakes118

Files

d2e0ca83c471779fad3c41bc5e9a9789_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1c2d42a4e533f3c86f1f4597355c880c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenGroups
CloseEventLog
CryptGetHashParam
CryptSetHashParam
DeleteAce
DuplicateToken

kernel32

WinExec
ExitProcess
TerminateThread

msvcrt

_chkesp
_ctype
_eof
_except_handler2
_CIacos

Sections

.text
Size: 259KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 752KB - Virtual size: 752KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE