29310b92c60e5c74dc0c279ef57bf6dd_JaffaCakes118 | Triage

Sharing

General

Target

29310b92c60e5c74dc0c279ef57bf6dd_JaffaCakes118
Size

206KB
MD5

29310b92c60e5c74dc0c279ef57bf6dd
SHA1

ae22e2f382fb58caf08e64c801a1c507555feb84
SHA256

0ded21a024f7811a55205c6ee0498a6c1bda9ad599cc9c2f149054ba3cd93638
SHA512

c142d05947e0134077dfe9df138113c0d2b38d4ef324399e51c6b0bfaede9660a1b2f971f1e63067185574d73d4ed72428a8bb4ae1e2b344ee549d03ff60c9ab
SSDEEP

3072:KdXJJwXdMH4xLjyWMcDUYBwkXEIRaMtopzto7TBNUUCb7HN+PXwiLtu112Ldu+JH:gaMWMfQLF7TBNM7H6XNY+uoL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29310b92c60e5c74dc0c279ef57bf6dd_JaffaCakes118

Files

29310b92c60e5c74dc0c279ef57bf6dd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cd60c66ce76de7dec7b7fac44c9e9937

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

advapi32

CryptDestroyHash
CryptHashData
GetUserNameW
RegCreateKeyExA
RegSetValueExA

kernel32

InitializeCriticalSection

shlwapi

PathMatchSpecW
PathRemoveFileSpecW
SHDeleteKeyA
StrCmpNIA
StrStrW
wnsprintfW
wvnsprintfA

user32

DispatchMessageA
GetClipboardData
GetForegroundWindow
GetMessageA
GetWindowTextA
OpenDesktopA
PeekMessageA
SetProcessWindowStation
ToUnicode

Sections

.krch
Size: 43KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.krkj
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bgr
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ