0dff15ab6ad5fd0e922d427374fd1e32_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0dff15ab6ad5fd0e922d427374fd1e32_JaffaCakes118
Size

153KB
MD5

0dff15ab6ad5fd0e922d427374fd1e32
SHA1

f90236d09bcb1f9dffe04995a79d007bc30a1d27
SHA256

f46236efd8ce718f9c3593cc997ba12a969c5b1e54a6a70d21f9f4161a2a248a
SHA512

c1ce017c9cee3a662643cd02249d39ba51b8e885f8a9711a5b327e50ad54b8fa1e0d9214e7e2c5cc21f99d4d09d2e1a778233f263cdf907e25b43aba4578e8ce
SSDEEP

3072:dxbckKhaePFmny5KHTua3d6+Axa4StSL+b:dxbcthaFnOCR3cxAtSLy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0dff15ab6ad5fd0e922d427374fd1e32_JaffaCakes118

Files

0dff15ab6ad5fd0e922d427374fd1e32_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f7f4ac3920b6d93936d07acc759b224b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetCommandLineA

rpcrt4

RpcStringFreeW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ