a8e1cf58d6ef9080a3e3b5184b2925d2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a8e1cf58d6ef9080a3e3b5184b2925d2_JaffaCakes118
Size

180KB
MD5

a8e1cf58d6ef9080a3e3b5184b2925d2
SHA1

4349d291647852a7f6ef31ab7f544b197661af75
SHA256

d444f431778d40baa28d8de946b56393beadf3e4e1e465cde57b3f5af7cc4be1
SHA512

bec27bd915f803aa2767b2e5dc97791f249a4ce8a9585667c59e7455e02e027a60f285b5032026c2705d84bac0e87f56c82feff44267e23a12b971ac56fb59e7
SSDEEP

3072:OH/VHlFlaqinfgUIDfyx9/1csiU5AEonVA1lb8T6N2ITWQRCETmGR/+di7l8:OH7batfuOxjcsNWEQ6NzoS2ip

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8e1cf58d6ef9080a3e3b5184b2925d2_JaffaCakes118

Files

a8e1cf58d6ef9080a3e3b5184b2925d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

903a37397beed656aa190e5e4429d8fb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

mprapi

MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName

rpcrt4

NdrFixedArrayFree
UuidCreate

kernel32

VirtualAllocEx
CreateProcessA
lstrlenA
MultiByteToWideChar
EnumResourceNamesW
GetSystemTimeAsFileTime
WideCharToMultiByte
LocalAlloc
OpenSemaphoreW
RaiseException
InterlockedExchange

advapi32

RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ