40ddd467127e3b1bf32041f53b75f2ce_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40ddd467127e3b1bf32041f53b75f2ce_JaffaCakes118
Size

49KB
MD5

40ddd467127e3b1bf32041f53b75f2ce
SHA1

aa6d2466291dc435b6ecf549dfef6cf7b1c500e9
SHA256

317bfe4cf6d7f5a259f57217438b226ba6f629672dd91e0ab95bf8e6a080f997
SHA512

c9b0efc06fac895ec09a9e8646feeae09416e876205d33454e6b2000c14d3c9e5ce7e8497f518e839e84bc8143b28d527783135bdf90f4296da10a6660914b07
SSDEEP

768:F+YosFMjgDybaw1HkSPkwL4KRdfffsWufttLzQVZCGtJnM9Wf95F2:UYoAMM+b9kSvfsRLzmCoJ+WTF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40ddd467127e3b1bf32041f53b75f2ce_JaffaCakes118

Files

40ddd467127e3b1bf32041f53b75f2ce_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4dee810b9dd885a0f7fc9646c555d78f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringW
ExitProcess
FreeConsole
GetDiskFreeSpaceA
GetOEMCP
GetProfileStringA
HeapUnlock
LCMapStringA
ReleaseMutex
SetVolumeLabelA
VirtualAllocEx

advapi32

CloseEventLog
CreateProcessAsUserW
CryptSetProvParam
EqualSid
GetAuditedPermissionsFromAclA
GetExplicitEntriesFromAclA
GetTrusteeTypeA
ImpersonateLoggedOnUser
InitializeAcl
ObjectCloseAuditAlarmW
OpenServiceW
RegConnectRegistryA
RegEnumKeyExA
SetEntriesInAccessListA
SetSecurityInfo

user32

CheckMenuRadioItem
DdeDisconnectList
EnableWindow
EnumWindowStationsW
IsZoomed
LoadImageA
PostThreadMessageW
RegisterClipboardFormatA
ToAsciiEx

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE