0ef95327855e39f9478a07b4911b9aa6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0ef95327855e39f9478a07b4911b9aa6_JaffaCakes118
Size

585KB
MD5

0ef95327855e39f9478a07b4911b9aa6
SHA1

d5b5023337549ba04048cd151f963384bd7b1915
SHA256

aa9a73fe98ac3324ba8eb003ca158a1efc761debf0c110e4dc8fe00d2f0f4295
SHA512

98ceca63659d153c5fa6d90d227dac01abf2a989a4ef0f9052791f13d39d6b8b5df7b8fed9b4ea876bf31be7a53ca4eb2a8d9a6fd18a2b34bbb849dab7ee93ed
SSDEEP

12288:1EVTOMsvhuH6w5AxRes2vumXGDoNfSQTEjxFzPpxILNTVAA1upH:1EhOMKhO6HfmWgqJpxILD1wH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ef95327855e39f9478a07b4911b9aa6_JaffaCakes118

Files

0ef95327855e39f9478a07b4911b9aa6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a379f2a908a29608c4df092ef021ce8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
TlsGetValue
ResetEvent
GetProcAddress
VirtualProtect
ExitProcess
SetEvent
IsValidLocale

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ