f794c106aec58b5d3abe78c2d69987d2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f794c106aec58b5d3abe78c2d69987d2_JaffaCakes118
Size

205KB
MD5

f794c106aec58b5d3abe78c2d69987d2
SHA1

e4ec2490839930282af1d534d235d1daa5b17a44
SHA256

37f5c685950a24268e117a6a4ba752c3b83e0955dab44d39134f907adbe46eba
SHA512

c513632d48b5735c18f31ef3cf75de730bba4d4b7c348b53f3629be3d7acbbd80415328c002fac3c4664420bd28bff044f4bc580d9bac97b6cc4f58700e47061
SSDEEP

6144:hl81SQWiXoqX+E+NvKN/3G2jhM+/Ix6ZmTQ:hl8a9MN7tjLIx6ZmTQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f794c106aec58b5d3abe78c2d69987d2_JaffaCakes118

Files

f794c106aec58b5d3abe78c2d69987d2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6cd5cefcbfef60ac6ad7f9f82bdfbd46

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCmpNIW
wvnsprintfA
wnsprintfA
PathFindFileNameW
wnsprintfW
StrCmpNIA
PathRemoveFileSpecW
PathFileExistsW
StrStrW
PathCombineW
wvnsprintfW
PathMatchSpecW
SHDeleteKeyA

advapi32

RegCloseKey
CryptGetHashParam
CryptCreateHash
CryptReleaseContext
RegQueryValueExA
RegDeleteValueA
DuplicateTokenEx

Sections

.yhst
Size: 39KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.azsd
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qlgt
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ