043f420a082799a9158a577f22c1286e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

043f420a082799a9158a577f22c1286e_JaffaCakes118
Size

83KB
MD5

043f420a082799a9158a577f22c1286e
SHA1

84ed92bb115f84e5643542783418ea10fca39d82
SHA256

b4de8d7858688004f14c74b9edd580a468c9b9788bc2f2af38fb6a2656088be3
SHA512

abd917a385ca6e09c9ef0cc858424f851d775672db6210cbb1ad172253091c3cbf78bc54bcf490ddc80ac900759942fb6d26fcb47d40dfd9425cbd5c157eb69b
SSDEEP

1536:7DwTCxe/oU5ygWxVigz3Dk6TJefX/qJgm5LXqQi6ljEErxTWDTMqhGKYIZTET8bc:7D7xe/5bW/9zA6TJSqWoL6IjBkMqhGKy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
043f420a082799a9158a577f22c1286e_JaffaCakes118

Files

043f420a082799a9158a577f22c1286e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd83c0b24128d1fc499e3b099210e9ca

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetQueuedCompletionStatus
DosPathToSessionPathW
LZInit
QueryMemoryResourceNotification
GetStringTypeExA
WriteConsoleInputW
LZOpenFileA
GetConsoleKeyboardLayoutNameA
GetModuleHandleExA
WaitNamedPipeW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zrdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE