efd0396a2ff1a5d3eff2939f69185dc7_JaffaCakes118 | Triage

Sharing

General

Target

efd0396a2ff1a5d3eff2939f69185dc7_JaffaCakes118
Size

77KB
MD5

efd0396a2ff1a5d3eff2939f69185dc7
SHA1

146787a29c56285216ea918e4645493fbdb803a0
SHA256

c1d19b51cc31d7fa82bc16affd834b3c2fa29fb18bc5f05b6a31f56268b1609c
SHA512

de51669674396bcc2f1490dfe7b922fca532270cf965948030d66e0787a3486e4f14982eb65889a78eb1ec985bea34f25b0c5c00c7769b2f17de10953094806d
SSDEEP

1536:vdU1vPMNq/qVAPpAOEfIC6YKk/b4pKuSIa1h4KvAsv2s0URKpRLZRSmIN4xyl9Pg:e1vWoq6BAOgIC9VcpKu4h4SRXJKpRuUx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efd0396a2ff1a5d3eff2939f69185dc7_JaffaCakes118

Files

efd0396a2ff1a5d3eff2939f69185dc7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1db467b9fe906f5a8e600c281eb412cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

advapi32

FreeSid

gdi32

GetDeviceCaps

user32

GetDC

comctl32

ord17

version

VerQueryValueA

Sections

.text
Size: 21KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.PACKMAN
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE