3f6b7e2d250b04544e7e4c139c1e3497_JaffaCakes118 | Triage

Sharing

General

Target

3f6b7e2d250b04544e7e4c139c1e3497_JaffaCakes118
Size

63KB
MD5

3f6b7e2d250b04544e7e4c139c1e3497
SHA1

72e084e3ab99ad7b93f85f03c5b4cd5c9dce2940
SHA256

a06c85b83aad6fabbe367e29ae542f75641c9c2eef4c3b806a76eb8efc2a0c34
SHA512

43eea25a3ded5ec84a25bd4df036cbbc6fc510a72471bd4d7d4ed2595d939b7ab08398b2f64b6b24da08a103e81a79c4bacf24f8f34a269018570ad4e07dd982
SSDEEP

1536:vTfffo5FbWs6KPQm3plYAb5bMffQmG7EKODL2Ne:mFQep6sr7CG0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f6b7e2d250b04544e7e4c139c1e3497_JaffaCakes118

Files

3f6b7e2d250b04544e7e4c139c1e3497_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1dc490c9e90d460245f1ffb4a975576b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
SignalObjectAndWait
DecodePointer
Process32Next
MapUserPhysicalPagesScatter
IsBadStringPtrW
GetVolumePathNameW
ExtendVirtualBuffer
SetComputerNameA
FreeUserPhysicalPages
GetConsoleAliasesA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE