64be6128dc9dd2b5d98ee01aeb8d23d1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

64be6128dc9dd2b5d98ee01aeb8d23d1_JaffaCakes118
Size

444KB
MD5

64be6128dc9dd2b5d98ee01aeb8d23d1
SHA1

7da95cf676b924b6f325e8a25c895199634d07cd
SHA256

5c655b148b218072676f731a6c589d68f0c19b2fe3a04c4aea65486e141435db
SHA512

c3202eb395374872d726aca3eb8b6f56e0c03d9f3535c793feda9a957dd86fd60891068c69f719cb3ec72a860dd67027c14be193c5e61cff8bb02c33f1ce733a
SSDEEP

6144:3wlTqoqx4TYUIi3T7jXif7dL9rMA0rw7hTfeP3gbvNMqjemnJK0XTsp:3wlTqTATnYxxQc7EPQeqjJK0X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64be6128dc9dd2b5d98ee01aeb8d23d1_JaffaCakes118

Files

64be6128dc9dd2b5d98ee01aeb8d23d1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3eb9f3a645fcff610a289bc4624a38ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\src\fcrypt\Release\S\s_high.pdb

Imports

advapi32

DuplicateTokenEx
RegOpenUserClassesRoot
RegOpenCurrentUser

Sections

0
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.4Q3l3
Size: 419KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ