b46ea268c4aaeeaf4a03bd8421358d73_JaffaCakes118 | Triage

Sharing

General

Target

b46ea268c4aaeeaf4a03bd8421358d73_JaffaCakes118
Size

356KB
MD5

b46ea268c4aaeeaf4a03bd8421358d73
SHA1

690d8952490f48a36d76a8b34c148edc75f7d6cc
SHA256

1f25032fd28abb0c571fb7da7d78ffc3198bfe51dd3ed1e6d26c3062dc508b01
SHA512

eada7a2ed63139c23e0d2047c708f5c211648e481cc78ef4da6e6d8c2f05c773debe6efa6bb57ca34a489f973ba6f7420ff51c10e991deb7c6d9cc247e3ed128
SSDEEP

6144:DDpeorMD5X3IpwALtmsb5FJto9RpZemzQW3nsWX7ODF3k1Nr2lhkoL:HptMD5X3IpwAR5b5FE9RpZQWT7ORZz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b46ea268c4aaeeaf4a03bd8421358d73_JaffaCakes118

Files

b46ea268c4aaeeaf4a03bd8421358d73_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3eb9f3a645fcff610a289bc4624a38ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\src\fcrypt\Release\S\s_high.pdb

Imports

advapi32

DuplicateTokenEx
RegOpenUserClassesRoot
RegOpenCurrentUser

Sections

0
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.4Q3l3
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ