f6138744facb3201d43453011ec8a59c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6138744facb3201d43453011ec8a59c_JaffaCakes118
Size

63KB
MD5

f6138744facb3201d43453011ec8a59c
SHA1

7fc86f4b76f5a4239a8cd4bb70039686959068cc
SHA256

3a797b2af6b62d867cbd767af69933dade70aeb744f656003f4623f709bebc75
SHA512

9d9420d12d631dba32502ef7b7250d923e2ca86e1935c68727dc587818bf68ecdffe355b69e877372e547758b84019e43f1333b8c9684b50a9ddf37a2e7dd42c
SSDEEP

1536:WpN3nHwUi4ntuJdfgb5/FdJRYLUQazeP10l5PXhczlk60GGmP:mHwULuJdobRFd4LXazePWlxexrWmP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6138744facb3201d43453011ec8a59c_JaffaCakes118

Files

f6138744facb3201d43453011ec8a59c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a08199de3b0b016221e19b2c1fc314cc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetPrivateProfileStructA
EnumUILanguagesA
MulDiv
ScrollConsoleScreenBufferW
lstrcmpW
OpenProcess
SetConsoleMode
PrivMoveFileIdentityW
CheckRemoteDebuggerPresent
CreateSemaphoreA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE