4275042ed721fdd724c0505905424cb3_JaffaCakes118 | Triage

Sharing

General

Target

4275042ed721fdd724c0505905424cb3_JaffaCakes118
Size

78KB
MD5

4275042ed721fdd724c0505905424cb3
SHA1

3268b61575c3d9366077c1cf1aff82e172339169
SHA256

0232138141a8ffc1a62bf66c1e73bf3c259b117fce5c445d1838d64c930c0334
SHA512

9cc7c8641f4bc4b00d4a9cceb69612bf025236544f1ab3a84f49e7044e73baa4e43ea921fa0d87236a7c49d3f611b806b8fcd7fe5971f000fb597ab1a4b6b9f4
SSDEEP

1536:Tz59xHZWNst/3dLi5QXQ0GZwfmfiihfTV/ySdQ+62ZL3:ZtJXXGwIb1S+62h3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4275042ed721fdd724c0505905424cb3_JaffaCakes118

Files

4275042ed721fdd724c0505905424cb3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3c4591e38680557b08e44e396d47dbe2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetProcessVersion
MoveFileA
GetTempFileNameA
CloseHandle
GetModuleHandleA
lstrcmpiA
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

wcslen
_snwprintf
NtConnectPort
RtlAbortRXact
RtlInitString
_wtoi64
RtlAddAccessAllowedObjectAce
RtlSetControlSecurityDescriptor
RtlInitAnsiString

Exports

Exports

Wkkuhmiwh
Afvelgv

Sections

.text
Size: 4KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 70KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ