2b733df48b88010a13eff07455e67dc2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2b733df48b88010a13eff07455e67dc2_JaffaCakes118
Size

97KB
MD5

2b733df48b88010a13eff07455e67dc2
SHA1

a2f6122e76a3f31625d78bd2f1626478074021fc
SHA256

e2c7ef3322e1167aa94920a76f6ec0c8f7693b82d42556c207487d84258cf392
SHA512

a8ce567d8f085e3ed04604b0915d0530896f7c4b2884d24fb08ede79519c1784d01eab47281fe36faa6105228452864331f240daf10ec7ddd86f6616f79ff36f
SSDEEP

3072:Kkkdd5tUsMNz5/pu5KAPY+Fv2PgBYv7B3QMvZ:rKd3rPfFv2PVv79V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b733df48b88010a13eff07455e67dc2_JaffaCakes118

Files

2b733df48b88010a13eff07455e67dc2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

df1387544d755e8316253f86622e47df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
VirtualProtect
GetModuleHandleA
ExitProcess
SetConsoleScreenBufferSize
GetStartupInfoA
GetModuleFileNameA

advapi32

GetTokenInformation
ReadEventLogA

Exports

Exports

InitDqhonpfbyow

Sections

.text
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ldata2
Size: 16B - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 87KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enull
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ