257a967dc6803ab165e6bf5d5346e467_JaffaCakes118 | Triage

Sharing

General

Target

257a967dc6803ab165e6bf5d5346e467_JaffaCakes118
Size

56KB
MD5

257a967dc6803ab165e6bf5d5346e467
SHA1

281f9ccb6b86e7e0f7ddc12ca831ae1b405c2fbe
SHA256

e6eefec3b83ade3ce45e641f3f9ffc2ef0a8b5797f4acdeda3a8dc4e6e7a5726
SHA512

59c2aab3394da445fe3c7064868be62b2cbf9c8d994fd659db2b288067899f3a4c60a90bf21b05c098bbfe784e407b9272a311168aeb0e0ea7d8aa55e10e25b4
SSDEEP

1536:bJHIo25qG/zWuXV1djXHpOWm8xJBVBivG:b1VmqGLjjj3cWmiJBZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
257a967dc6803ab165e6bf5d5346e467_JaffaCakes118

Files

257a967dc6803ab165e6bf5d5346e467_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b45a31c9ac673539f1ff1dbd35bd8d49

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
WriteConsoleInputVDMA
CreateProcessInternalWSecure
FindNextVolumeMountPointW
DuplicateHandle
FindVolumeClose
AllocConsole
GetModuleHandleExW
GetStdHandle
AddAtomA
SetMailslotInfo

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE