df89fa9ecbf23da9b351559f54c7ebb6_JaffaCakes118 | Triage

Sharing

General

Target

df89fa9ecbf23da9b351559f54c7ebb6_JaffaCakes118
Size

118KB
MD5

df89fa9ecbf23da9b351559f54c7ebb6
SHA1

0ec0138a7b705c2e0078ba219012158697879171
SHA256

08b7ac25e26f3389a02992677b0b1214e8a17114e659a4ee634431194e36e524
SHA512

09233aee7cb7d246e94e82404f09e622cf558f760852286b2e48934bcb2d0473a38c14454a4ff419f6d3f6d9f341dff5ba3035dec0f688822edfcc9f1233635e
SSDEEP

3072:SkgVMgGS7IDIx4FKta21PKDXXHR2OsWHG:sUSUDo4tbHFG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df89fa9ecbf23da9b351559f54c7ebb6_JaffaCakes118

Files

df89fa9ecbf23da9b351559f54c7ebb6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

af84ae547296727eb1b3f26c7cfc3b8c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextVolumeW
HeapCreate
CreateFileA
GetStringTypeA
ReadConsoleW
SetVolumeLabelA
CloseHandle
CloseHandle
GetConsoleMode
FindFirstVolumeW
GetVolumePathNameW
GetModuleHandleA
GetCurrentDirectoryW
CopyFileA
GetEnvironmentVariableW
GetFullPathNameW
CreateSemaphoreA
GetFullPathNameW
CloseHandle
Sleep
VirtualFree
CreateFileMappingA
GetModuleHandleW

dbghelp

FindFileInPath
ImageRvaToVa
ImageRvaToSection
ImageNtHeader

Sections

.text
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_WRITE

.RES
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avdr
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ