0159d7a7e05b613204aa7c5841985a2a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0159d7a7e05b613204aa7c5841985a2a_JaffaCakes118
Size

172KB
MD5

0159d7a7e05b613204aa7c5841985a2a
SHA1

f0dd16ee5fe3ed067a71cf281044f65e4c9a4746
SHA256

c16e0b16aefc4d213d6100134e1711d903fe45d7ae1a0a17d1b9d8b9c69a3d7d
SHA512

7cc48f35c4a3e49f07291b5308caba2da0a96506e0c468d744d059be89e52d98f1e30f1e5473080086a62d4b160776333994f1f1a2ce55901a6e65e4fbf5205b
SSDEEP

1536:qk8zGbInr4LDUQwLV9PTCAtVGEWoFK/aJ+64f7tVv1tj4RqGs2xQXWVji77A857H:jqYInrgy5FVGlowL68vH4XVY8+uZMh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0159d7a7e05b613204aa7c5841985a2a_JaffaCakes118

Files

0159d7a7e05b613204aa7c5841985a2a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e1e3e176a20a98e2535ad4ea6fd74a84

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlRandom
ZwQueryInformationProcess
ZwProtectVirtualMemory
LdrFindEntryForAddress
RtlDosPathNameToNtPathName_U
ZwAllocateLocallyUniqueId
ZwSetInformationObject
swprintf
wcscat
wcscpy
RtlImageNtHeader
RtlFreeUnicodeString
RtlStringFromGUID
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
wcslen
RtlPrefixUnicodeString
RtlGetCurrentPeb
ZwOpenFile
memcpy
memset

kernel32

CreateProcessW
GetTickCount
GetSystemTimeAsFileTime
ExitProcess

advapi32

MD5Update
MD5Init
MD5Final

Sections

.text
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE