892626ba70f22a5c7593116b8d2defcf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

892626ba70f22a5c7593116b8d2defcf_JaffaCakes118
Size

37KB
MD5

892626ba70f22a5c7593116b8d2defcf
SHA1

ab41a0bc0e3dbcc7d48b674ec079f55eac6dea13
SHA256

7a436727bac86927ec9d51db86899ffc0b0f92feb1d426c5f2141d94f7d29e13
SHA512

f48e8248f68c2a8d9d3f567850ecbc88ed79e7f75dc5e9295615e5355b853e555abf904735e27d38e34120ef3a0cf2f1cad780142ef8a330b148e0bfc69805de
SSDEEP

768:3XLJmx0iPed1zpMZ87vvQkVq4Y994iM1OLsPRyeqZeK6KK/0XM:3XLExSd1zpV7vYkYy1OgPRyeo6K40XM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Supplementary Agreement 26_01_2016.scr

Files

892626ba70f22a5c7593116b8d2defcf_JaffaCakes118
.zip
Supplementary Agreement 26_01_2016.scr
.exe windows:5 windows x86 arch:x86

67ef42078ff0fa6e633d4e8d0e87faba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

J:\Krypton_15.0_SR\Bin\StubNew.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
LocalAlloc
GetExitCodeThread
LocalFree
RtlZeroMemory
CreateThread
lstrcpyA
SwitchToThread
WaitForSingleObject
OutputDebugStringW
ExitProcess
LoadLibraryW

user32

OpenClipboard
GetActiveWindow
MessageBoxA

advapi32

RegCreateKeyExA
SetEntriesInAclA
RegCloseKey
FreeSid
AllocateAndInitializeSid
AbortSystemShutdownA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyA

winmm

mciSendStringA
mciGetErrorStringA

userenv

GetDefaultUserProfileDirectoryW

winspool.drv

ClosePrinter
OpenPrinterA
EndDocPrinter
ord201
StartDocPrinterA
EndPagePrinter
WritePrinter
StartPagePrinter

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ