dfef08c0610db00e712770620e9b04fa_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dfef08c0610db00e712770620e9b04fa_JaffaCakes118
Size

83KB
MD5

dfef08c0610db00e712770620e9b04fa
SHA1

7f72f207ccf2380fef62b722d0bfad16bc1aa007
SHA256

e24286376adf09216fb9f3d7f600f0f2a3dfa37a643a6e36fd8cfb9d6b022d7a
SHA512

3452663cc37939c4bbc17e7dea12f94973a15a064d4d67dabfa89fdb8a5db662f0771cf3dba38087913b9f7ce0affd39114566c0d30e591bc0622c03cb591a27
SSDEEP

1536:5oldFFofJEQ9cwulXm+hBNb1Awhk5qoiwhjbvV++LwtBVajEErxTWDTMqhGKYIZg:5olnzzQ+pb18qexo1tBwjBkMqhGKZTbY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfef08c0610db00e712770620e9b04fa_JaffaCakes118

Files

dfef08c0610db00e712770620e9b04fa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

568d8203ba5fc3fcbfb3dc7f25e376cb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFiber
GetConsoleCommandHistoryA
SetComputerNameW
FindNextVolumeW
LoadLibraryExW
LocalShrink
FindNextFileW
CopyFileExA
FindActCtxSectionGuid
Module32First
GetFileAttributesW
CheckRemoteDebuggerPresent

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zrdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE