0349ca4db3a1bf9aba3c2ce61d7a9b99_JaffaCakes118 | Triage

Sharing

General

Target

0349ca4db3a1bf9aba3c2ce61d7a9b99_JaffaCakes118
Size

985KB
MD5

0349ca4db3a1bf9aba3c2ce61d7a9b99
SHA1

be4728d61149b6697d93955558851a673c0969d6
SHA256

ca1bcef0bfc476f240daa7d46a45f88bbdc2282ca7e50edf8eaa18e2cbfec1ef
SHA512

0f5ae7049f1529b80688ed7eb6595a8a156ceecf7939c4add746e7979ca29a2faef94d387ce83a7c3f2d5d151dcb4ce442b466e5bbe3522966dd683b10d96d4f
SSDEEP

24576:4w6TLqE6IzA5CIZ7TGHaqPIesbQv8NDjQxUvWXSuyZ:QeEy32B035k32

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0349ca4db3a1bf9aba3c2ce61d7a9b99_JaffaCakes118

Files

0349ca4db3a1bf9aba3c2ce61d7a9b99_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e2a38d9ad3409a50dc844fb8deec2bb8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysAllocString
VarI1FromI2

kernel32

GetModuleHandleA
GetStartupInfoA
GetCurrentProcess
MultiByteToWideChar
InterlockedIncrement
ExitProcess
TerminateProcess

Sections

.text
Size: 841KB - Virtual size: 840KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.version
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ