0d7e3fc98a950559f890c46eb9d6b75e_JaffaCakes118 | Triage

Sharing

General

Target

0d7e3fc98a950559f890c46eb9d6b75e_JaffaCakes118
Size

14KB
MD5

0d7e3fc98a950559f890c46eb9d6b75e
SHA1

0738e437ed5d1d0d14ea08161ede91dec85b1a11
SHA256

6511fdcc0654f11b5dc3eb10f20fdf1b0e44b0729ded784a1f58ca23b276c31d
SHA512

e14af676c378e30db7339c3eb9d06ee23f19d484e1b78d3361dd34ba440d1981ea99c793e693da445bcb5df177d37b1edcbbf81a5cb7a05b0c35a310a2b84993
SSDEEP

384:HLpLJKrHkNWKIUdbM8rjLZwsY5goOvQ/LUe4pCa808sC:HLpLkE8sjrj9wR51OvQ/h4o2C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d7e3fc98a950559f890c46eb9d6b75e_JaffaCakes118

Files

0d7e3fc98a950559f890c46eb9d6b75e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f916318fcef033c188614e20a3b73d61

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetFileAttributesExA
GetFileAttributesExW
GetLongPathNameA
GetTapeParameters
GetThreadSelectorEntry
HeapSize
SetConsoleTextAttribute
SuspendThread
Toolhelp32ReadProcessMemory
UnmapViewOfFile
UpdateResourceA
WriteFile

advapi32

AddAce
BuildExplicitAccessWithNameA
GetFileSecurityA
QueryServiceLockStatusA
RegEnumKeyExW
SetAclInformation
SetSecurityInfoExA

user32

CreateIconIndirect
FillRect
GetClipCursor
RegisterTasklist
UnregisterClassA

shell32

CheckEscapesW
Control_FillCache_RunDLL
ExtractIconExW
ExtractVersionResource16W
RealShellExecuteExA
SHGetDataFromIDListW
SHHelpShortcuts_RunDLLA
SheGetDirW
ShellExecuteExA

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE