ae3364e8287bbee5255681cc116cc550_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ae3364e8287bbee5255681cc116cc550_JaffaCakes118
Size

48KB
MD5

ae3364e8287bbee5255681cc116cc550
SHA1

85d23ab003ac7a7b3ef42ab0de378ce0ccd9ad33
SHA256

8e440c977e553b902a24851028a21fde7e7944ca26b951bafbb7996f86654c29
SHA512

7e484b7162cdc494178bd15d25009d00f4a70f0be60a602d1b919f2d9b8e0ac08fd3ba3e60686b2daf61e8b2b3fea88e214cab9a6a96ed698a06b8109db7b8b6
SSDEEP

1536:36B6pkD4QNLGdKOgZOwgi7dACAXMolA3/mslTUKEOj:ktD4hgIiBAhm/tlTw8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae3364e8287bbee5255681cc116cc550_JaffaCakes118

Files

ae3364e8287bbee5255681cc116cc550_JaffaCakes118
.exe windows:5 windows x86 arch:x86

511d9379862aeb2bde0d875cbb783566

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW
SHDeleteKeyA
PathFindFileNameW
wvnsprintfW
StrCmpNIW
PathMatchSpecW
StrStrW
PathRemoveFileSpecW
wnsprintfW
wvnsprintfA
PathCombineW
StrCmpNIA
wnsprintfA

advapi32

CryptCreateHash
CryptReleaseContext
RegCloseKey
DuplicateTokenEx
CryptGetHashParam
RegDeleteValueA
RegQueryValueExA

Sections

.vefkr
Size: 39KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.erkriv
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mhqfij
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ