31f3902ed6b02879fa40db9dafb3d5d9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

31f3902ed6b02879fa40db9dafb3d5d9_JaffaCakes118
Size

57KB
MD5

31f3902ed6b02879fa40db9dafb3d5d9
SHA1

99d8fea6726c931e1dba8febae9a0c54bc6d1bea
SHA256

22c89798a2e038c4bc455e7934365c69e6cde6615f6d05a430e4f69546570933
SHA512

19e00e975412ead6cafc79db08bc26e79d287208e31ea36152237da2d7f3baae797337e3c3052b35ed8ff03ee2ef7e60e6e8f9283c1988f8d4e125878c3f2830
SSDEEP

1536:LQ9r29XWv+bf6iimRZjMQ5/BB1P0vhuJbffDG:7Tf6iLHr/BHPmCXDG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31f3902ed6b02879fa40db9dafb3d5d9_JaffaCakes118

Files

31f3902ed6b02879fa40db9dafb3d5d9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

52eac45c64c932f8dee2735616522a59

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AllocateAndInitializeSid
ChangeServiceConfigA
CopySid
CryptEncrypt
GetAclInformation
GetMultipleTrusteeA
RegDeleteValueA
RegUnLoadKeyA

kernel32

VirtualProtectEx

shlwapi

UrlIsOpaqueA

user32

DrawMenuBar
EnumClipboardFormats
GetClipboardFormatNameA
GetComboBoxInfo
GetTopWindow
ImpersonateDdeClientWindow
PackDDElParam
SetDebugErrorLevel
SetMessageExtraInfo
SetScrollInfo

Sections

.wxcf
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.horsj
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wbsr
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yhoxa
Size: 25KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ