0b744ec1e9e48f5bccedea6743a394d3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b744ec1e9e48f5bccedea6743a394d3_JaffaCakes118
Size

476KB
MD5

0b744ec1e9e48f5bccedea6743a394d3
SHA1

8b84f88bd4f9e8b37ec6d4899944accb58b48c94
SHA256

e9366787611c79bd21ad05c0eaa63033c328103a1c1dcbd49c84ddc2eb5e9823
SHA512

d3ac27cf01362a0e0cab9a43d8a21aa8b1f4ad85815b23ba05e93c196a23480900c0cf9759eaf15d06651743963ba84afaf18d6d7a9eabfbff689865c9a6bb94
SSDEEP

12288:tkUUfOTl0b0MaUH3yfd8v9Q8SDOBs5FjSnfg1N:tWgK0w+K+bSCqkN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b744ec1e9e48f5bccedea6743a394d3_JaffaCakes118

Files

0b744ec1e9e48f5bccedea6743a394d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6ba2b07782d800642ed5ff06af22dfa2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3

kernel32

lstrcatA
GetProcAddress
GetModuleFileNameA
lstrcmpA
lstrcpyA
LoadLibraryA
ExitProcess
GetCurrentProcess
HeapFree
HeapAlloc
GetEnvironmentVariableA
GetStartupInfoA
GetCommandLineA
GetProcessHeap
lstrlenA
GetModuleHandleA

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ