172705358cfa4d296fc41cb9f6c6886a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

172705358cfa4d296fc41cb9f6c6886a_JaffaCakes118
Size

8KB
MD5

172705358cfa4d296fc41cb9f6c6886a
SHA1

2dc1f806f5673cc0ec115be2d0ede0aa707fc0ec
SHA256

97266e1f372b12bc49c1f38d6ee5c86d7157da4f991e1ea0d338c18881c303c9
SHA512

3e3b72cc16e9b7768cc4cf5a25a1f97d91b402f1acadc802e94418460351c04191f02e049cb20b2391c9f314401589af19bf4a39732588b493393396b6489783
SSDEEP

192:PmQ0wM3PZuX4PTCz03O8tkomM1UCROoy4:/M3PZp3O8tkomM1HROX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
172705358cfa4d296fc41cb9f6c6886a_JaffaCakes118

Files

172705358cfa4d296fc41cb9f6c6886a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e8d4e2e944275b465880a1c28831c968

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_access
strcpy
rand
memset
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
strchr
realloc
sprintf
free
_vsnprintf
_strdup
strlen
malloc
strcat
strncmp
strcmp

kernel32

GetVersionExA
WriteFile
CreateFileA
GetTempPathA
GetTempFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
LoadLibraryA
GetProcAddress
lstrcmpA

advapi32

CryptAcquireContextA
CryptDestroyHash
CryptDecrypt
CryptReleaseContext
CryptHashData
CryptCreateHash
CryptDeriveKey
AllocateAndInitializeSid
RegEnumKeyA
CheckTokenMembership
FreeSid
RegQueryValueExA
RegCloseKey
RegOpenKeyA

urlmon

ObtainUserAgentString

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE