18bcac584330a3e667867988731479d7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18bcac584330a3e667867988731479d7_JaffaCakes118
Size

327KB
MD5

18bcac584330a3e667867988731479d7
SHA1

472aef881d1f86250ac5559544cac1f5120ae80f
SHA256

6b3952fbab195cd17bd6fadaabbc702aa693831eabb9b41508668c70b1c04f48
SHA512

71cd15609aecc7e792e8865f0a90635d1d246c8a25c2319bc84a2c68ac142a8f6bbbeb85c0f765eb7bf834f3751e18c62da6f334690a8127f605d4c5e7f128e6
SSDEEP

6144:2QDJGa1zoj9p1MjYegKvEcy6m3lp8A7Qf/K2uHG1RPr2X4B8WjNtz:9Jmb17egKrm1bC/K2z2oBH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18bcac584330a3e667867988731479d7_JaffaCakes118

Files

18bcac584330a3e667867988731479d7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5e075e46ecbeba977690dfddbb44eba7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadStringPtrA
CloseHandle
GetModuleHandleA
GetDriveTypeW
CancelIo
FreeConsole
FindClose
SetLastError
ResetEvent
IsBadReadPtr
LocalFree
LoadLibraryExW
GetDateFormatA
VirtualProtect
DeleteCriticalSection
TlsGetValue
GetLastError
EnumResourceTypesA
GetDiskFreeSpaceExA
GetCommandLineA

advapi32

GetFileSecurityA
CloseEventLog
IsValidSid
OpenEventLogA
LsaFreeMemory
LsaSetSecret
LsaClose
CloseTrace
FreeSid
RegCloseKey
RegLoadKeyA
AccessCheck
RegCreateKeyExA
RegCloseKey

osuninst

IsUninstallImageValid
ExecuteUninstall
GetUninstallImageSize
RemoveUninstallImage
ProvideUiAlerts

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ