ae599e4ac20b096a7bb02d7e21fa662e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ae599e4ac20b096a7bb02d7e21fa662e_JaffaCakes118
Size

61KB
MD5

ae599e4ac20b096a7bb02d7e21fa662e
SHA1

d79dd123cc194d47666fbe6a3aadfc512c2facd2
SHA256

93897c2a150abf9607e2650500056f5ec571f09093b115953036bde73453689c
SHA512

c537d3b79254f8609daba13a6323bd29535e84c1b61e6f7712142d33c04bd13a6f9cbccf845e4fa44a134d49f3887fe73b10f30e075323d238cbb4920b35afdc
SSDEEP

1536:d/nUx/q4MDobmBtfjiy38pSCtWr35vp6n:1yq4hbct7idvtWD3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae599e4ac20b096a7bb02d7e21fa662e_JaffaCakes118

Files

ae599e4ac20b096a7bb02d7e21fa662e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3cce68a090bdf2bee3ec19f01d091f80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecW
PathFileExistsW
wnsprintfW
wnsprintfA
PathCombineW
wvnsprintfA
StrStrW
wvnsprintfW
StrCmpNIW
PathFindFileNameW
SHDeleteKeyA

user32

DispatchMessageA
LoadCursorA
SendMessageA
SetProcessWindowStation
OpenDesktopA
ExitWindowsEx
GetIconInfo
GetKeyState
CloseDesktop
CharLowerBuffA
DrawIcon
GetWindowTextA
GetClipboardData
EndDialog
GetWindowLongA
GetForegroundWindow

kernel32

VirtualProtect
CreateFileA
Sleep
MultiByteToWideChar
GetCommandLineA
WaitForSingleObject
SystemTimeToFileTime
InitializeCriticalSection
VirtualAlloc
CreateEventW
lstrcmpiA
FindClose
GetSystemTime
CreateThread
GetFileTime
lstrlenW
SetFileTime
lstrcpyA
WideCharToMultiByte

advapi32

DuplicateTokenEx
RegEnumKeyExA
CryptHashData
RegCreateKeyExA
RegQueryValueExA
CryptReleaseContext
RegDeleteValueA

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE