27e083ed8f57ca7b20b744ed407280a3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

27e083ed8f57ca7b20b744ed407280a3_JaffaCakes118
Size

56KB
MD5

27e083ed8f57ca7b20b744ed407280a3
SHA1

984d83d70871d80736a58bbf33721423d274808a
SHA256

cd1b0e31274be344fe5a1909f019673134ab59f837e3f50b513087473c309f96
SHA512

218df90651d0e928f033c55601cf06be370e0c3da6f26c8fad6cd87e81b79b734643b2eee0e563881b4e4f39f155635b8bdc52fdef244f7d7e7b749ae1b09dcd
SSDEEP

768:YFpbQyS8Gn8U8qXVzaj/KxSwm4C80Z7Q40SBHfqCnZ9l9fXU/CMJSFo8ozVmFib9:EPLMS7P88sSwYlPoL4aVmkRqzbO/oK5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27e083ed8f57ca7b20b744ed407280a3_JaffaCakes118

Files

27e083ed8f57ca7b20b744ed407280a3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

965c45e9138805564c6374f875ff3ad7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadCodePtr
GetCommModemStatus
LockFile
SetLocaleInfoA
CopyLZFile
WaitForDebugEvent
LoadLibraryW
LoadResource
BaseQueryModuleData
CreateVirtualBuffer
GetFileAttributesExW
SetComputerNameExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE