f54480376b6a9f8c70f53ea566f9b7b2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f54480376b6a9f8c70f53ea566f9b7b2_JaffaCakes118
Size

79KB
MD5

f54480376b6a9f8c70f53ea566f9b7b2
SHA1

f13d3d837ac49f6b476deb257a64b27196a868b9
SHA256

86c1edba48d7e9140cb1867e5e4675cae08efa4de9c34b2eb262333a2b3eefac
SHA512

e624ca26d631c3c9c953a6561a352108e1874d307bf1c33e044519a927d05881ca8735d751f22015b0533099c0899b53419b7e927a226cd537e473efa2d56a9b
SSDEEP

768:0Lop5KUJ3ZZkCqZLcqtAS6Nl+47r1SxEkjPFfBSZ3FenhaBAkQjOkSupuiKHIg11:IIfZUZQVBx7Z0FPFJSrenhaY9TKH2SxX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f54480376b6a9f8c70f53ea566f9b7b2_JaffaCakes118

Files

f54480376b6a9f8c70f53ea566f9b7b2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9af64e1da43b03d826a76d96ab3105f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
ReadFile
ReadConsoleOutputCharacterW
VirtualProtect
GetModuleHandleA
GetStartupInfoA
GetModuleFileNameA

user32

UpdateWindow
SetWindowTextW

Exports

Exports

GetEsorlebguyy

Sections

.text
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata1
Size: 66KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrd
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ