15c098f215f108dd16a33b50dadf4c7d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15c098f215f108dd16a33b50dadf4c7d_JaffaCakes118
Size

2.8MB
MD5

15c098f215f108dd16a33b50dadf4c7d
SHA1

bc7e3df48e2fd6d3c4f18b2d6446e8517a0cbfd1
SHA256

813a5b17bab792aa65118548f5e6040226cc6feca7ebe7a912c486c075275137
SHA512

22e4453b3cb14cefb56fc82ebfb5fcef1982aaa95424a220ae86080daca5ff8165e55c23233913a05a402b1e60bdfbfc787bfd493c835d36ce4e4874b6c8ae65
SSDEEP

49152:nKEFgnR+u6pj4NcGwwTgMbTdpTuBOJ8P26tVekvVqToIG2ER3G:KEk6uOodTdpTJ8P2C4kk8Op

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15c098f215f108dd16a33b50dadf4c7d_JaffaCakes118

Files

15c098f215f108dd16a33b50dadf4c7d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6da67c9233f938ee3dd65be2aabc2449

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32Next
GlobalWire
VirtualAlloc
SetEnvironmentVariableA
LeaveCriticalSection
UnlockFile
InitializeCriticalSection
WaitForSingleObjectEx
TerminateJobObject
GetNumberOfConsoleInputEvents
GetTempPathA
lstrcpynA
GlobalSize
SetFileValidData
DeleteCriticalSection
FindNextVolumeMountPointA
GetConsoleMode
GetFullPathNameA
TryEnterCriticalSection
EnterCriticalSection

authz

AuthzAddSidsToContext

Sections

.text
Size: 780KB - Virtual size: 780KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 93KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ