0b742d7beed562db619dd09d611789d9_JaffaCakes118 | Triage

Sharing

General

Target

0b742d7beed562db619dd09d611789d9_JaffaCakes118
Size

90KB
MD5

0b742d7beed562db619dd09d611789d9
SHA1

d3895296b2f9f357d4e379624095fa40068cb14e
SHA256

a6078a4d6f40a7a2c66645760f682f0ca40f52261e3509ff6069145ef65ecfda
SHA512

c68728702a552de3ec396e22a3452dbd6a7f4af8fd4c243216b28ab11ed6ed4f6b0b9805638de984b95cd4f9a299ebd30846f76122454aeffa1da796ea0337b3
SSDEEP

768:YCjhlkzVFuIGqih9bC4V1r2fAY7Yr/c5Er+faY2phB3hH6lDi/C:hvkOfbCU1yAY7YrEyUnGD3hH6lDi/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b742d7beed562db619dd09d611789d9_JaffaCakes118

Files

0b742d7beed562db619dd09d611789d9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9f45d57790418aafa62fb55eebd1258a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
SetEvent
VirtualProtect
GetCalendarInfoA
FindVolumeClose
FindAtomA
ReleaseMutex
GetStartupInfoA
CloseHandle
FindClose
GetModuleHandleA
Sleep
GetLastError
SearchPathA
GetTickCount
FindResourceExA
DeleteCriticalSection
lstrlenA
CreateMutexA
TlsGetValue

advapi32

RegEnumKeyExA
FreeSid
LsaFreeMemory
OpenEventLogA
LsaClose
CloseTrace
RegCreateKeyExA
RegCloseKey
AccessCheck
GetFileSecurityA
IsValidSid
LsaSetSecret
CloseEventLog
RegLoadKeyA
RegCloseKey

msdtcuiu

DtcPerfOpen
DtcPerfClose
DllRegisterServer
DllGetClassObject
DtcPerfCollect

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ