321fb6b811206b90ff83e1f3488bda24_JaffaCakes118 | Triage

Sharing

General

Target

321fb6b811206b90ff83e1f3488bda24_JaffaCakes118
Size

333KB
MD5

321fb6b811206b90ff83e1f3488bda24
SHA1

5e558db8e5ed7fe73e1a1bd275e5fa372fe8b13d
SHA256

067225f98fc475a912a00e61c2491449c0847fecd73c49fd6713b00bc531691c
SHA512

b57a5e009c2c42a83ee27cec1320c86d9ca0bc536dac15708b30f46b983f8fa53478ebcce76a799ce70ffdafde2fda6f0968e85cbf4cbaa7dc67848d1054dc2a
SSDEEP

6144:4P8/UV13izkygSQTCo2zfdDHWWl9PWY0GF9s7tcj0:4PqI1SP12V2zlDHWc9Omj0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
321fb6b811206b90ff83e1f3488bda24_JaffaCakes118

Files

321fb6b811206b90ff83e1f3488bda24_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bf10a00418e400956615fea046879568

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
GetThreadLocale
lstrcmpiA
ResumeThread
CreateHardLinkA
TlsGetValue
VirtualProtect
GetLastError
GetStartupInfoA
AddAtomA
SetEvent
HeapSize
DeleteCriticalSection
HeapDestroy
CloseHandle
GetTickCount
GetModuleHandleA
SearchPathA
Sleep
GetTempPathA
ExitProcess

advapi32

RegCreateKeyExA
LsaSetSecret
FreeSid
RegEnumKeyExA
RegCloseKey
GetFileSecurityA
AccessCheck
CloseTrace
IsValidSid
RegLoadKeyA
CloseEventLog
LsaClose
OpenEventLogA
LsaFreeMemory

cfgmgr32

CM_Add_Range
CM_Delete_Range
CM_First_Range
CM_Add_IDA
CM_Get_Child

shell32

DragQueryFileA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ