0038121a78eb1879cfa54176a9054d72_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0038121a78eb1879cfa54176a9054d72_JaffaCakes118
Size

232KB
MD5

0038121a78eb1879cfa54176a9054d72
SHA1

8d0972ad7cfd813adab485d99addeb26bc493e90
SHA256

b2c80c7cec73e5023a0706353e341b49a6490be719cc9ff39ac7016ff0df7823
SHA512

ed0201f4570137a15a6058947b5278bffc6a56704fa586a264192137982faf60805817a2a2d9eec5699adae10f8657837725ff07e4f5d0b95242d2c181a650c2
SSDEEP

6144:VRgkEjLlTtHv23g5RDusnZaiz2tMTClD324mk9bRmWf3:VR0RTtO3gPp0tMTP4mcbEWf3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0038121a78eb1879cfa54176a9054d72_JaffaCakes118

Files

0038121a78eb1879cfa54176a9054d72_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8544293ac8b74ef5c21b7cc72b5c3ba8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueA

kernel32

lstrlenA

shlwapi

PathCombineW
PathFileExistsW
PathFindFileNameW
PathMatchSpecW
PathRemoveFileSpecW
SHDeleteKeyA
wnsprintfW
wvnsprintfA
wvnsprintfW

user32

CloseWindowStation
FindWindowExA
GetClassNameA
GetClipboardData
GetKeyboardState
LoadCursorA
PeekMessageA
SendMessageA
SetProcessWindowStation
ToUnicode

Sections

.zcd
Size: 44KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ylobuj
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fcr
Size: 6KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ