b014acb6fae8c522a1a99420dce3237c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b014acb6fae8c522a1a99420dce3237c_JaffaCakes118
Size

79KB
MD5

b014acb6fae8c522a1a99420dce3237c
SHA1

699f125ae1261df720cf5f9a8367ea6310bb61c7
SHA256

1b2b21dd70d28281ead6dc8a38865ba28a8cb9d9feed517e8a4ec049fc6d9e38
SHA512

eaa6040dafb13ab9470899c42220d295ad76aba2a893d0f5e7b322679bb97c127c9c122d2028db6f6cce7fc13189d4909d60d45240cc2225fe088f276332d908
SSDEEP

1536:KrIAccVZEm8rbrzyhZk6AyB7eG4RthW5Z4kwk3ZOel:KcAccVALenHBi/vKASOQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b014acb6fae8c522a1a99420dce3237c_JaffaCakes118

Files

b014acb6fae8c522a1a99420dce3237c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bf10a00418e400956615fea046879568

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
GetThreadLocale
lstrcmpiA
ResumeThread
CreateHardLinkA
TlsGetValue
VirtualProtect
GetLastError
GetStartupInfoA
AddAtomA
SetEvent
HeapSize
DeleteCriticalSection
HeapDestroy
CloseHandle
GetTickCount
GetModuleHandleA
SearchPathA
Sleep
GetTempPathA
ExitProcess

advapi32

RegCreateKeyExA
LsaSetSecret
FreeSid
RegEnumKeyExA
RegCloseKey
GetFileSecurityA
AccessCheck
CloseTrace
IsValidSid
RegLoadKeyA
CloseEventLog
LsaClose
OpenEventLogA
LsaFreeMemory

cfgmgr32

CM_Add_Range
CM_Delete_Range
CM_First_Range
CM_Add_IDA
CM_Get_Child

shell32

DragQueryFileA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ