d2064e27fc6a33e06865ef3c19791fc2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2064e27fc6a33e06865ef3c19791fc2_JaffaCakes118
Size

96KB
MD5

d2064e27fc6a33e06865ef3c19791fc2
SHA1

52e6438579545eeced5b8db207daa043bd84252c
SHA256

0f41bf7b7921a67a948f8a1ab94acbb54b6b1d1ba5807fb448142438bf55ec8f
SHA512

4333c84f442535d46c9b2c4b449bd04340209e829d385cd9069754857d96526a97573a526ebb6494ed559d92bab473b823f724547baecf80c90b5564ee74a03b
SSDEEP

1536:k+qqVKxio3WexXycn43i7WS+g7Lpr0WBpgPpDKyH18CvKjHsx+lYgRh71QLE:3qMKx1GCn4SSeLZJgpTvyMSBhhQLE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2064e27fc6a33e06865ef3c19791fc2_JaffaCakes118

Files

d2064e27fc6a33e06865ef3c19791fc2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

784c8e7439e8e0bff69b5396355b6d25

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BaseCleanupAppcompatCache
GetNumberOfConsoleInputEvents
FindFirstChangeNotificationW
lstrcmpi
EnumSystemGeoID
AddLocalAlternateComputerNameA
FindActCtxSectionStringW
LocalCompact
ConvertFiberToThread

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE