19d1736c0aa2d51c260b8e18947c52d2_JaffaCakes118 | Triage

Sharing

General

Target

19d1736c0aa2d51c260b8e18947c52d2_JaffaCakes118
Size

51KB
MD5

19d1736c0aa2d51c260b8e18947c52d2
SHA1

181786530c8a511e0c8e91cb249253e880401034
SHA256

5083a5b4323d7744662283b3bf890bd79036ab5dd78fb2c6019afec7152c0a17
SHA512

0dc547f641d9cae34b24b7ed9e7439ff2a61d6e0027cfd34b7e9493e26cbf25df3cbe71b4b9eb8d9005f5ca07ce023658dd27cb195a177618ce0c221234f7f45
SSDEEP

1536:MjPnkGknkJs8DopxIlbRZOBKlrfio4ERXET:qPnkNKJDopelbRZOBK4dERXc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19d1736c0aa2d51c260b8e18947c52d2_JaffaCakes118

Files

19d1736c0aa2d51c260b8e18947c52d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c904371ae29ccf1326f8c940bf781bfa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringW
ExitProcess
GetPrivateProfileIntW
GetTempPathW
GetUserDefaultLangID
OutputDebugStringA
WideCharToMultiByte
_hread
lstrcpyn

advapi32

AllocateAndInitializeSid
AreAllAccessesGranted
CryptDuplicateKey
CryptHashData
CryptSetHashParam
GetServiceKeyNameW
MakeSelfRelativeSD
NotifyBootConfigStatus
ObjectCloseAuditAlarmA
OpenEventLogW
RegDeleteValueA
RegEnumKeyA
RegLoadKeyA

user32

CallMsgFilterA
CharUpperA
DrawFrameControl
IMPQueryIMEW
IsCharAlphaNumericA
IsCharUpperW
LoadIconW
MessageBeep
PaintDesktop
SetPropW
UnionRect
VkKeyScanExW
keybd_event

shell32

DoEnvironmentSubstW
DragAcceptFiles
FindExeDlgProc
InternalExtractIconListA
InternalExtractIconListW
SHGetDiskFreeSpaceA
SHGetFileInfo
SheSetCurDrive
ShellExecuteA

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE