38c382c8d8669b80b8bf8b64e3952789_JaffaCakes118 | Triage

Sharing

General

Target

38c382c8d8669b80b8bf8b64e3952789_JaffaCakes118
Size

51KB
MD5

38c382c8d8669b80b8bf8b64e3952789
SHA1

2419de26e98a4b73fad949fb2273f45d8c11b9a5
SHA256

4dc4020a0708eb28727ee2a20046ca409bcb3375c6904c693e112bbc523907ad
SHA512

cd52df09a3e95564a13e3c205e970944566fdc01055af96b887d50a97104cf3d00adeedf27e55dcb57a6f4058dd2ab412624d93e9e67cba9f4357631f49fce99
SSDEEP

1536:65VPovmvdJGHj9rOLxkOrXWhE+HFh8Cb:S9TvT8QqOrXO3N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38c382c8d8669b80b8bf8b64e3952789_JaffaCakes118

Files

38c382c8d8669b80b8bf8b64e3952789_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1233a3df875b05708d9d3138f4366411

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryW
DeleteFileW
EnumDateFormatsA
ExitProcess
GetCurrentThreadId
GetLongPathNameW
GetModuleHandleW
GetVersion
GlobalAddAtomA
LoadLibraryExA
QueryDosDeviceW
SetComputerNameW
SetProcessAffinityMask
SetVolumeLabelW
WritePrivateProfileStringW

advapi32

CryptEncrypt
GetAce
GetNamedSecurityInfoExW
LookupAccountNameA
LookupPrivilegeValueW
RegEnumKeyA
StartServiceCtrlDispatcherW

user32

DdeAbandonTransaction
DrawFocusRect
DrawFrame
GetDlgItemInt
GetInputDesktop
GetMenuItemRect
GetWindowModuleFileNameA
IsCharLowerA
MsgWaitForMultipleObjectsEx
OemToCharBuffA
RegisterClassExA
SetWindowContextHelpId
SetWindowWord

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE