26b0ca49fe176dea98dce96bf2d2fcc2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

26b0ca49fe176dea98dce96bf2d2fcc2_JaffaCakes118
Size

92KB
MD5

26b0ca49fe176dea98dce96bf2d2fcc2
SHA1

a58245d1ba94d176b9a9133776c7cb9ff6ee8ada
SHA256

6590953e6c45b528d80da75cceb6b79f18c5600905fca87ad3e920c91a0ca6ce
SHA512

2dc52ff19a9ce109144e4e75ce1cc00bb1fee2aa9fefd40dc4023dd9b62e49e99f162e43370a2d803a147d83841305757f6931cf11c6e53efc9c54bbbb038db8
SSDEEP

1536:usa+tClmk+eSGfx+oBLD3Ioj0J/9P7sNj/hvT2xgxr5HSGIZb++gKg:3tvk+mVR0J/94NjB225yV++9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26b0ca49fe176dea98dce96bf2d2fcc2_JaffaCakes118

Files

26b0ca49fe176dea98dce96bf2d2fcc2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bf07721f1dcd3b285a78deca800c04e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
DeleteFileA
GetConsoleAliasExesLengthA
TlsGetValue
BackupSeek
GetCommMask
IsValidLocale
RegisterConsoleVDM
SetConsoleNlsMode
DebugBreak
SetEndOfFile
ConnectNamedPipe
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

RtlLockHeap
strncat
NtDeleteFile
NtCreateFile
NtWriteFile

Sections

.rdata
Size: 4KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.adata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

WEIJUNLI
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ