eb8ddba438286d7be5c073da1f8ea4b0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb8ddba438286d7be5c073da1f8ea4b0_JaffaCakes118
Size

265KB
MD5

eb8ddba438286d7be5c073da1f8ea4b0
SHA1

575bb4b39ddb85af03ffa0a5a2a5f34e40c09a47
SHA256

81d7e475321e6dd0aee84cd3b845f7720e0ff2253fa49023b9c98bb6c33798d6
SHA512

63587b516f254e71eacc547e213ea47e5aeaf72a8427474a7769f86bad7dca7695bb51d45c1a7daf8646dc29b83a109b6472e322d5e8827be386ea1383328325
SSDEEP

6144:FYuvxm+zIuVS5DL3IXGD8xI7F8BzRblo0iPRz1X2WmE:FZx/3ShjDWI7+zRxDiPjJv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb8ddba438286d7be5c073da1f8ea4b0_JaffaCakes118

Files

eb8ddba438286d7be5c073da1f8ea4b0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

netsh.pdb

Exports

Exports

ConvertGuidToString
ConvertStringToGuid
DisplayMessageM
DisplayMessageToConsole
FreeQuotedString
FreeString
GenericMonitor
GetEnumString
GetHostMachineInfo
InitializeConsole
MakeQuotedString
MakeString
MatchCmdLine
MatchEnumTag
MatchTagsInCmdLine
MatchToken
NsGetFriendlyNameFromIfName
NsGetIfNameFromFriendlyName
PreprocessCommand
PrintError
PrintEventLog
PrintMessage
PrintMessageFromModule
RefreshConsole
RegisterContext
RegisterHelper

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 33KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yvs
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE