178343833e0a164a5fe563ee9f2770e6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

178343833e0a164a5fe563ee9f2770e6_JaffaCakes118
Size

31KB
MD5

178343833e0a164a5fe563ee9f2770e6
SHA1

1c7dbb1b058f5c0aa68ba8bdf9f33a410197d3b6
SHA256

0240c52911d6ab54e886e90d421765927dcd1219453df2d4d422d388ddda3392
SHA512

911110dfd26bd8cf13833df7ce78285f90a60585bdaaaaedf783ba98482c5d294fcc73e6df33844c4562973eebddad7b5fb1d3db89c8d4a8c084807fbe2c9a0f
SSDEEP

768:ZfNFBYn4ak5JqxpUC+lBRks+iCtdAnhFMvxG:fMn7PxklBRks+iLnPa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
178343833e0a164a5fe563ee9f2770e6_JaffaCakes118

Files

178343833e0a164a5fe563ee9f2770e6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dd4ea6758d1d5ba41f0be2bab478683c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
ExitProcess
GetStartupInfoA
HeapDestroy
DnsHostnameToComputerNameA
RtlMoveMemory
ShowConsoleCursor
FoldStringW
GetEnvironmentVariableA
CreateJobObjectW
GetVolumePathNameW
FindFirstVolumeW
GetFileAttributesW
EnumSystemLocalesA
WaitNamedPipeA
ReadConsoleOutputCharacterA
GetCurrentThreadId
GetTempPathA
WriteProfileSectionW
GetCommState
WaitForDebugEvent
LocalUnlock
TransmitCommChar
EnterCriticalSection
GetAtomNameW

Sections

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ