466b5b34f26ef4b83ad4c47cea7f9092_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

466b5b34f26ef4b83ad4c47cea7f9092_JaffaCakes118
Size

48KB
MD5

466b5b34f26ef4b83ad4c47cea7f9092
SHA1

faf557d6eb1354f1d1c6f00640f5a871e7ef63d0
SHA256

cd62a29d835290147a3956ff67b29315bbb7e3f245e2d57477b99a3f7ab66b42
SHA512

b81780e10ff5932bd57292c250bb2b3b25ac7abe9fcae24b4124645ed44910310404b0089fbc69a889bb6c3a75ec993ad35eab4714878e81d15656243ed0c2c0
SSDEEP

1536:9ln99ICmCGav8qLe5HZnk2I35LwETaxOY:9z9ICkzb9C9TGOY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
466b5b34f26ef4b83ad4c47cea7f9092_JaffaCakes118

Files

466b5b34f26ef4b83ad4c47cea7f9092_JaffaCakes118
.exe windows:5 windows x86 arch:x86

904ac0a6d225fe3897c260b69a303714

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
CryptGetHashParam
RegQueryValueExA
RegSetValueExA
DuplicateTokenEx
CryptHashData
GetUserNameW
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
RegDeleteValueA

kernel32

GetCommandLineA

shlwapi

PathCombineW
PathRemoveFileSpecW
SHDeleteKeyA
wvnsprintfW
wvnsprintfA
PathMatchSpecW
PathFileExistsW
StrCmpNIW

Sections

.mfibwx
Size: 39KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.laj
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ezobcn
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ