3100cc9ef7b1bddea8fc0b996698eb68_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3100cc9ef7b1bddea8fc0b996698eb68_JaffaCakes118
Size

56KB
MD5

3100cc9ef7b1bddea8fc0b996698eb68
SHA1

ae2351ab650e75f11a418d206056fba8c5a37c0d
SHA256

be8e66fb42a31366ec7bfd1f9ac8f0e8091d311107ad37e64e0152ac984a3ac1
SHA512

9f8944f987ae4ded4ed0f49ed0219bc4a9d48c6ac7b49c69787e834dcd7afa424704d307b0d3f6560cf0dd92a99f60faef053f6d75bbbde81f0e31908a164198
SSDEEP

768:Bw8JvAQnydjpnHtSAMdYyTPOT15Z2fUF19qFTSq13R/k86ee2gOPhYg1GmJ2QCVP:hyll0OTX0fUcSqJC86eeROPhYg1GgQf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3100cc9ef7b1bddea8fc0b996698eb68_JaffaCakes118

Files

3100cc9ef7b1bddea8fc0b996698eb68_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8f9b9b18b7ca49a772e0a1286476c334

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsValidCodePage
SetCommMask
BeginUpdateResourceW
LockFileEx
GetProcessHeaps
MoveFileExW
WriteConsoleOutputW
CheckRemoteDebuggerPresent
FreeResource
FindFirstChangeNotificationA
CreateDirectoryA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE