17d89e904825f5aa7283fa0b3c66a4b3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17d89e904825f5aa7283fa0b3c66a4b3_JaffaCakes118
Size

3.4MB
MD5

17d89e904825f5aa7283fa0b3c66a4b3
SHA1

af1462c8df3f1f8ce5764d8f26bdb68a3e99bf36
SHA256

98fb28a5685ed103f3600e7058200987500d0c401682c502b84234f627d0450f
SHA512

d9a0d16658a7ab72e1fc0354867d56384d14294149f487288e84f6610f0c3377f803deb7ab072c419dff335900309fc950be2510f7eb9b4d5ce055e2deda8216
SSDEEP

98304:yxy8B6XNI4jWzaccaah69tyt99XzSUVYU2MB:yD6e4jWzamo69tyL9Sd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17d89e904825f5aa7283fa0b3c66a4b3_JaffaCakes118

Files

17d89e904825f5aa7283fa0b3c66a4b3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b0784f2189b637be1627f09d14ea297b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

netshell

NcFreeNetconProperties

ole32

CoCreateInstance
StringFromGUID2
CoInitializeEx
CoUninitialize
CoTaskMemFree

msvcrt

wcscat
wcslen
wcstoul
wcscpy

advapi32

RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW

kernel32

HeapAlloc
GetCurrentProcessId
GetSystemTimeAsFileTime

samlib

SamAddMemberToAlias

ntdll

NtAllocateVirtualMemory

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 15.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 941KB - Virtual size: 941KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE