1705659c81f2f825ade1ecf512154b4b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1705659c81f2f825ade1ecf512154b4b_JaffaCakes118
Size

163KB
MD5

1705659c81f2f825ade1ecf512154b4b
SHA1

024f54e1723fa7e57c9d1a18c61784409c8e399a
SHA256

67791d2f6a53d99f79de9f82ea89609e996585b7c4b6a79e4acfde7ce3eee3f0
SHA512

a7e2dc3a416fe3e57cdc9281e8cf81de8b7d044c38ecbc93d718d5e97825cd20da451faa2bbd548160fa1aa35f9a69a9890d8a58dbbd9098a7d08fab5bf7cf91
SSDEEP

3072:l0B5vXt0xGmhWRiN5R5f07SfEVkVvzwsp7Y:It9OFLR8R6Vvl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1705659c81f2f825ade1ecf512154b4b_JaffaCakes118

Files

1705659c81f2f825ade1ecf512154b4b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bb31c8a6edd51222143361512d66e426

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetDesktopWindow
CharNextA

kernel32

OpenProcess
GetCurrentProcess
VirtualAlloc
RtlMoveMemory
lstrlenW
GetDriveTypeA
VirtualFree

Sections

.text
Size: 512B - Virtual size: 426B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Yax. Bci
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ