04e17656d9823650234e7b49887dd4c0_JaffaCakes118 | Triage

Sharing

General

Target

04e17656d9823650234e7b49887dd4c0_JaffaCakes118
Size

371KB
MD5

04e17656d9823650234e7b49887dd4c0
SHA1

014030e87a6cae93e03e344ccaa383d040b5be23
SHA256

0176775e37dd6887b645e53cb635faf2a4aaf89646404854803c706802106f8b
SHA512

fca3c3753c6e7df73e282dedf28748e6bea16e2a34ac1f8e3e80c99e5d44fc2e5625998b9a6e0e0992abcbc82881b282eb6dc98e72e85db471195f04f2430223
SSDEEP

6144:pfUe6W+C71VFvBMEblyI+c3aY2ysYTlRUhHP5pnjgB0+y2ncwSsRMr75T1DnkAN:pfUfCJV9blH2nvHP5VV+dSsyx5z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04e17656d9823650234e7b49887dd4c0_JaffaCakes118

Files

04e17656d9823650234e7b49887dd4c0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5889801be72d31babfbd0b1b3cf8fc76

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CredFree

dhcpcsvc

DhcpUndoRequestParams

kernel32

RaiseException
HeapSetInformation
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
Sleep
TerminateProcess

user32

GetMessageA
RegisterClassA

ole32

StgOpenStorage

Sections

.edata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 275KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ