543f770dc1bb8b6b0ad6fa5a8d3fdda3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

543f770dc1bb8b6b0ad6fa5a8d3fdda3_JaffaCakes118
Size

76KB
MD5

543f770dc1bb8b6b0ad6fa5a8d3fdda3
SHA1

602f24b6dfa44948ebfe658fbd9a1210de13e868
SHA256

d8fe163441c107c7985d992e40c5b4e3b292b93807f0c010cebf339d73ff988d
SHA512

947848d67a764e509170a2ee37c8244a071a9e0121693b669e22f7205159f93ba8bbbea0730c8f83a601793a83b07abc8da7db0f42f4474e53435784d757a70f
SSDEEP

1536:Rhb5pmaZBn03Ig2Q6G9hu1pTs7V61KUanQpjVrs2ryrd1vUQuq6:jbbzZE1urTs7MKfnQHs2qo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
543f770dc1bb8b6b0ad6fa5a8d3fdda3_JaffaCakes118

Files

543f770dc1bb8b6b0ad6fa5a8d3fdda3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d973983af1401f3de5672ef91e807ef0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempFileNameA
QueryActCtxW
GetConsoleWindow
DecodeSystemPointer
FindNextVolumeA
SetDefaultCommConfigA
ReadConsoleOutputA
GetModuleFileNameW
TransmitCommChar
CreateDirectoryExW
InterlockedDecrement

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE