37c08c4d66f85ab744a87443e4bd5faf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37c08c4d66f85ab744a87443e4bd5faf_JaffaCakes118
Size

52KB
MD5

37c08c4d66f85ab744a87443e4bd5faf
SHA1

f7197d33266dba4da1c9b03cac6dc6175e05ebc2
SHA256

eb298c20f4221ca4a3cb8c9286ccc7f192a3ae8d3f900d4d06abbfd2e99cc856
SHA512

94a51a5c8e0b357f97e068c8093f58aaf267ae5f9fe62973a0e3e9b723c5f3f4725ced255d089c437f6ba7e59af4294d012c0184e592937bd36a028bfecbf276
SSDEEP

1536:Y37TMLZqWRXMOPaQyBuIVRRBo45j4oPJxQ22Tgeg:YsLZqWRXMGafuS9oeg22T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37c08c4d66f85ab744a87443e4bd5faf_JaffaCakes118

Files

37c08c4d66f85ab744a87443e4bd5faf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ab178bfdda168fb992635b0e5ee4936b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringA
EnumSystemLocalesW
ExitProcess
IsBadHugeWritePtr
OpenWaitableTimerW
SetMessageWaitingIndicator
VirtualProtect

advapi32

BuildImpersonateExplicitAccessWithNameW
ConvertSecurityDescriptorToAccessNamedW
ConvertSecurityDescriptorToAccessW
CreateServiceW
CryptAcquireContextA
DestroyPrivateObjectSecurity
GetSecurityDescriptorLength
GetSidIdentifierAuthority
LookupSecurityDescriptorPartsA
MakeAbsoluteSD
RegCreateKeyW
RegGetKeySecurity
RegLoadKeyW

user32

CloseClipboard
DefDlgProcA
DlgDirListW
DrawTextW
GetClipCursor
GetNextDlgTabItem
RegisterHotKey
SendIMEMessageExW
SendMessageTimeoutW
SetMenuItemInfoW
SetWindowTextW

shell32

Control_RunDLL
ExtractAssociatedIconA
PrintersGetCommand_RunDLLW
RegenerateUserEnvironment
SHBrowseForFolder
SheFullPathA
Shell_NotifyIconW

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE