be462f9e2361006b4463e61041b77ff4_JaffaCakes118 | Triage

Sharing

General

Target

be462f9e2361006b4463e61041b77ff4_JaffaCakes118
Size

1.2MB
MD5

be462f9e2361006b4463e61041b77ff4
SHA1

f53e3052dba745a1218c44de0f6018cae378dc9f
SHA256

c00b4815694f13db6da7166df017846a456b8fa53db78d9960cd6f37e743122f
SHA512

9c386eafeb8bacee84a1552a87eaf9efdad0041fd5d16d41d7fac6b65ecebfa5dc419ce47021874ceadf819de46ce99e33b7d723ae36dbc45a6fe9da2d98ded7
SSDEEP

24576:L6xqzBBycNHDy/SkXD8S7JWWZS1VfuN4C3cC9shRc/WGXcrrH:9f59sXD37JpsVkshOkH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
be462f9e2361006b4463e61041b77ff4_JaffaCakes118

Files

be462f9e2361006b4463e61041b77ff4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

eb6a90bd692c88d7415acbcb4b26dfb4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetCurrentProcess
CancelWaitableTimer
VirtualProtectEx
ExitProcess

user32

DestroyCaret
GetActiveWindow
GetWindowLongW

ntdll

NtReadFile

Exports

Exports

InitEfyrbrvei

Sections

.ztext
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.kisdhq
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.batfhq
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ