f99c18ab0d28cc7aaa6eaab4ece09f09_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f99c18ab0d28cc7aaa6eaab4ece09f09_JaffaCakes118
Size

54KB
MD5

f99c18ab0d28cc7aaa6eaab4ece09f09
SHA1

20a8a97bed7f3ad1c808a62613885b83a4fc0722
SHA256

875c4eb9c9f8cf49942439f007ae66413bc41a02fcdfcee9e5256bc9bde8fdf0
SHA512

1a109472131720a3e5ccda3f035cbcabff0b0a8d7072991518ab54b7befc72a8770522e2879c94443a2faaf8b60ac7897828bb88257877c3ba38bc8491f5eda0
SSDEEP

768:LFYx2yMYq7jtQBaBRtV7kEp9+kqfPFIsY9HReBMyTkr8d54Id0xMFb6iV:LFy2/YoRtV7kEpYPfqTx1/wd5Klm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f99c18ab0d28cc7aaa6eaab4ece09f09_JaffaCakes118

Files

f99c18ab0d28cc7aaa6eaab4ece09f09_JaffaCakes118
.exe .ps1 windows:5 windows x86 arch:x86 polyglot

6704b2b77763aefcbb42033a5c63bbd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
VirtualAlloc
TerminateProcess
LeaveCriticalSection
GetLastError
GetCurrentThreadId
WideCharToMultiByte
DeleteCriticalSection
CloseHandle

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ