ef0d636ffaf8b1a9c854cee0681da976_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef0d636ffaf8b1a9c854cee0681da976_JaffaCakes118
Size

63KB
MD5

ef0d636ffaf8b1a9c854cee0681da976
SHA1

4d9b9aa03e307463832cc78eba076fc38fef2546
SHA256

199d79abd86ed3f825aae0f58b490521ade3fffc2d3a9fbfa5f111c81cf903bd
SHA512

638a4e053c6fedf5b6f1f6ca0eed6d4380eaae672440d9cb915d8d8fffa70e1926b6c7d7fc22aa608b0327b6d170105c01093993d41b7c17857a852f913fe81e
SSDEEP

1536:sJNyetm06UbqmmFJo8a7DzHlZF5fqoxPog/42ihMRrB5Bhj:sJNyeGUbqmmwnLHKoJog/4Qthj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef0d636ffaf8b1a9c854cee0681da976_JaffaCakes118

Files

ef0d636ffaf8b1a9c854cee0681da976_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e6b06865a331530903690b4d234ca6c7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleInputVDMA
CloseConsoleHandle
ReadFileEx
GetDiskFreeSpaceA
InterlockedExchangeAdd
DebugActiveProcess
GetDiskFreeSpaceExA
lstrcpynW
RegisterWaitForSingleObject
BackupRead
GetNumberFormatA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE