ad91aafbede83cec63324643be004029_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad91aafbede83cec63324643be004029_JaffaCakes118
Size

177KB
MD5

ad91aafbede83cec63324643be004029
SHA1

004a249697817b2b52c670440f07494819424323
SHA256

839c5a719514668950605e3b99f0fe80f2d421c77c9aaa8c3eb8103cea21d515
SHA512

44a7cbc7581ec6b67b0ea3e190d123ed3254f03f0fea3c967f268efcfedfa411b3f4f93dc7ec09c2970f19286c4ba89975eb9491a397154d0ceeadb7ce731f5d
SSDEEP

3072:gQGvFCoFsg/kEtMd/p0NG9DLbB0w3G8+UCBvPQX+t+jNivDIFG:EvgodsEtMd/pUG9Dtf7CtuNivDx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad91aafbede83cec63324643be004029_JaffaCakes118

Files

ad91aafbede83cec63324643be004029_JaffaCakes118
.exe windows:4 windows x86 arch:x86

973fa9204d9f6a2a472213f6f5c49623

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

kernel32

VirtualQueryEx
lstrlenA
LocalAlloc
GetSystemTimeAsFileTime
EnumResourceNamesA
CreateProcessA
WideCharToMultiByte
RaiseException
MultiByteToWideChar
OpenFileMappingW
InterlockedExchange

oleacc

LresultFromObject
CreateStdAccessibleObject

ole32

StringFromIID
ProgIDFromCLSID
CoTaskMemFree
StringFromCLSID

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ