104c85090014cf720f510bc3fedc7002_JaffaCakes118 | Triage

Sharing

General

Target

104c85090014cf720f510bc3fedc7002_JaffaCakes118
Size

91KB
MD5

104c85090014cf720f510bc3fedc7002
SHA1

b59851970abc608a9ad5f75e4d0aedde9b08c27d
SHA256

99b95363fa53d270ea40f4c06d43baddd9728a46d726a75311fca280212846db
SHA512

f6f100d9f58a5366d50d294989e67feedadd39e3a2bd95ec2221f957cd68437c53e10de92d3640f6b739f051b4df7b917f120afd6ad37842511fee393f43fc0b
SSDEEP

1536:/CzCXvZBLlELRI35kaxNiP2vP2KNEMfdGp1kNe8kLJlSUDIPOLIHzZR5FtvID:/DBLuLwSaTievPzNEM8fkNeZ7SExezt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
104c85090014cf720f510bc3fedc7002_JaffaCakes118

Files

104c85090014cf720f510bc3fedc7002_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b3ec0db09e0ca1e37cd4a978fb8b84fa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LZOpenFileW
SetConsoleCtrlHandler
UnregisterWaitEx
EnumSystemLocalesA
DeleteCriticalSection
FindActCtxSectionStringW
GetComputerNameExA
CreateFileMappingA
DeleteFileW
UTRegister
DecodeSystemPointer

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lrdata
Size: 35KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE