d50baada75881d5b7e2ada00350409b3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d50baada75881d5b7e2ada00350409b3_JaffaCakes118
Size

56KB
MD5

d50baada75881d5b7e2ada00350409b3
SHA1

ee0f9169f87b4844f1822660465751e53344b222
SHA256

b985eb25a75758ac09aa5792ead0d9a7fe1e1ba167ebbb565d80352f8a49f179
SHA512

ddc99294dd7010779bc559e665696c358e93d741a983e4f1277b0afe0f734f4f7d2a86d2e8ee317c52f1992448fbd8fc277735ad21c0c48a21efffcdf398b221
SSDEEP

1536:/NIb1OjWKSQmL4tdtAO1PO+M7iSBjaMbhVC/cNHPX9O7DhCYQ4:Fo1hQO4tdikWFBjlVCTP8H4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d50baada75881d5b7e2ada00350409b3_JaffaCakes118

Files

d50baada75881d5b7e2ada00350409b3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

732192071c2b750728b4ba444a057041

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLongPathNameA
DebugActiveProcess
GetVolumeNameForVolumeMountPointA
GetProcessHeap
HeapCompact
GetConsoleCommandHistoryW
GetVDMCurrentDirectories
SetProcessAffinityMask
GetModuleHandleA
CreateVirtualBuffer

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE