04ae6f3f18769b066e043e7194d4c25c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

04ae6f3f18769b066e043e7194d4c25c_JaffaCakes118
Size

745KB
MD5

04ae6f3f18769b066e043e7194d4c25c
SHA1

bbc88dfda8d72d078b378b570880eeffe65f734e
SHA256

ce14a4f8abd351323ee97bf45f063b666e68a5bc59c3c9a2d6c227f7d449bf06
SHA512

1173727aedbad16aa3e8a3ad73498cfa44ac1ee15a3737dc5430d4737b3399258aa957924ec47d26de109136da8aa509012c189fc25c5e3ff1c46bb56f88167f
SSDEEP

12288:++L6G/qz6FE+MtHnaSYJelwPIYxEw09G2dd2P2FkSv7yRpnj3eVD/U+PRvSjbkge:++WGCajM8ranYxhCGOdGkk07Ao/PEv/e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04ae6f3f18769b066e043e7194d4c25c_JaffaCakes118

Files

04ae6f3f18769b066e043e7194d4c25c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c2d30f2dcb7abc8e12a10baace874b27

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
DeleteTimerQueue
GetModuleHandleA
ResumeThread
GetLastError
IsValidCodePage
CloseHandle
HeapSize
VirtualProtect
CreateHardLinkA
GetStartupInfoA
ReleaseMutex
lstrcmpiA
GetTempPathA
HeapDestroy
DeleteCriticalSection
AddAtomA
GetDriveTypeA
GetTickCount
SetEvent
GetPrivateProfileStringW

advapi32

AccessCheck
GetFileSecurityA
RegEnumValueA
LsaSetSecret
RegCreateKeyExA
RegEnumKeyExA
LsaClose
CloseEventLog
RegQueryValueExA
CloseTrace
RegCloseKey
GetSecurityInfo
IsWellKnownSid
RegLoadKeyA
LsaFreeMemory
OpenEventLogA
FreeSid
IsValidSid

urlmon

CoInternetCompareUrl
CoInternetGetSession
CoInternetParseUrl
CoInstall
CopyBindInfo

perfos

CloseOSObject

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE