126605594d1fd5e0f683998a6326f6b0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

126605594d1fd5e0f683998a6326f6b0_JaffaCakes118
Size

58KB
MD5

126605594d1fd5e0f683998a6326f6b0
SHA1

9f3f868dfcf98ef4a7bc061d2c4e2d8c998b0e80
SHA256

4d8b9d51f47edeb62f667a158c3ae3ac2ce6d2dccd34be56dc2dee03fc8b0035
SHA512

471553a482c694a09503b59d2a48042212766b7ab77dfa3087975780ed76d69308b2cf91120f5c9e012afa190df5cd8c9110fce5ea8810d4cbc5e70d054d8d07
SSDEEP

768:JmyUU6ZQ29+bY0Q0lPtl6k/CoQdFv2cbOvgVUxGjAd8h1pfGIIPdT74plgAzu5Ad:Jm1Zzy3Q6Pt055O4wsLfIPd3n7BXZD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
126605594d1fd5e0f683998a6326f6b0_JaffaCakes118

Files

126605594d1fd5e0f683998a6326f6b0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

30636e03e9253cf350d01a4bd358c90c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToLocalFileTime
GetDriveTypeW
CreateNamedPipeW
CreateMailslotA
lstrcmpiA
lstrlenA
HeapCreate
SetLastError
lstrcmpiA
IsValidLocale
OpenMutexA
GetModuleHandleA
GetLogicalDriveStringsW
lstrcmpiA
GetStdHandle
GetVolumePathNameW
Sleep
GetModuleFileNameA
GetProcessHeap
lstrcmpiA
lstrcmpiA
WaitForMultipleObjects
DeleteFileA

scecli

SceOpenPolicy
DeltaNotify
SceSysPrep
InitializeChangeNotify

Sections

.text
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.adata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.orpc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ