17b1d758fda47ab2ce105577d4534810_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17b1d758fda47ab2ce105577d4534810_JaffaCakes118
Size

83KB
MD5

17b1d758fda47ab2ce105577d4534810
SHA1

995dd478be964ca3011c1d074bb27379bc01433a
SHA256

4849b7523d93096935491c123dc0383bebd2db9dd70f29cc76019c0eadc2b759
SHA512

ac0aec9c2f9d57fd3fb08d908e51da065d7ea38fe4be8d1c8937f513076d3094fd64be2f556c24ac00f939cd303728742640d988bf88b4f9bc05533ee12d084b
SSDEEP

1536:4pirFPiy1+aeosebKWMZHu/iTqi3KgpjVrs2ryrd1vUQuq:7T1+ihwuqTqLgHs2q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17b1d758fda47ab2ce105577d4534810_JaffaCakes118

Files

17b1d758fda47ab2ce105577d4534810_JaffaCakes118
.exe windows:4 windows x86 arch:x86

18da5eb8777c1445365de56a7fe2c3de

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiW
VerSetConditionMask
GetConsoleWindow
GetConsoleKeyboardLayoutNameA
GetConsoleCharType
FindActCtxSectionGuid
WaitCommEvent
QueueUserWorkItem
WritePrivateProfileStructW
VirtualProtect

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 27KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE