0bdc5627ec6bcbb2b986db7d37ba85d5_JaffaCakes118 | Triage

Sharing

General

Target

0bdc5627ec6bcbb2b986db7d37ba85d5_JaffaCakes118
Size

256KB
MD5

0bdc5627ec6bcbb2b986db7d37ba85d5
SHA1

7f612958a792812ffcb0300baa5acf8ab9ca6298
SHA256

ca651b40d5f35146eb827935469e37711f268e33a866e493a85744735c8dad9e
SHA512

f85fe562535f022d1c11c1a1c3bb885f99329512d38fd673beb5314eebf6e0507344aebaca9e2d01e8a19ef11086149c7a213682110b1c4e7a44cfb0818b2bce
SSDEEP

6144:0etIf/53MQ9nnJZLyXExD4n+/0TU1y+nX5L0MlDJX3:0eG/5cAnnbLXDk+0MvnX5LPV3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0bdc5627ec6bcbb2b986db7d37ba85d5_JaffaCakes118

Files

0bdc5627ec6bcbb2b986db7d37ba85d5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8676f4b95bd4e96eeac157bdcf1c8604

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetACP
WriteFile
lstrcpyA
IsBadReadPtr
lstrlenW
VirtualAllocEx
VirtualAlloc
IsBadHugeReadPtr
GetCommandLineA
WaitForSingleObject
ExitProcess
VirtualFree
GetProcAddress
WideCharToMultiByte
GetLastError
VirtualQuery
LoadLibraryExA
GetVersionExA

Sections

CODE
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ddata
Size: 4KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fdata
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ