0d8974c94c0b48bbae4790f3dddf3ad0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d8974c94c0b48bbae4790f3dddf3ad0_JaffaCakes118
Size

83KB
MD5

0d8974c94c0b48bbae4790f3dddf3ad0
SHA1

146eeb1b9d12cedc27f8fd2f712375377e896256
SHA256

2c59bb742c7e0d88f5be4427314370b17f98a8eb7d4fd96523049f30bec7a3ee
SHA512

435785cc1200307c873504e87c3145b15121d781105e46f6088fae48c5df2eab047156186bda2181da1b1f88d912be8bacc3481da29d0beb78c11fa7a54a7b10
SSDEEP

1536:0rzwtswld85ibhV0x+S7k/PXbIarIJCvt7DJvhHjEErxTWDTMqhGKYIZTET8bDQ:KEswP8cf0x+Sw/fbIfCvjRjBkMqhGKZg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d8974c94c0b48bbae4790f3dddf3ad0_JaffaCakes118

Files

0d8974c94c0b48bbae4790f3dddf3ad0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

583436ce8a41616be1ba5eb101ca1361

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetCPInfoExA
TermsrvAppInstallMode
SetConsoleKeyShortcuts
GetPrivateProfileStringA
LocalFlags
CheckRemoteDebuggerPresent
ReadProcessMemory
FindFirstChangeNotificationW
FatalExit

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zrdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE