b73f9c7af6a472d7ef55c7e344dc3cde_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b73f9c7af6a472d7ef55c7e344dc3cde_JaffaCakes118
Size

3.4MB
MD5

b73f9c7af6a472d7ef55c7e344dc3cde
SHA1

22bb505c6ef773c1fc1f187bd452d5be188c17f4
SHA256

4650d487ccd9383eb04109ad4105f6a949b5e424d7e6127c66cd9bb922debeb1
SHA512

e21a17428aa117b4dca806c823b1d8a778fe55d05446c5ec54b5a927924e46a5debfd6bda559bd1dbdc1be81bfc3adc270ec8d2366ac7abae41aaa82518c078d
SSDEEP

98304:yxy8B6XNI4jWzacUaah69tyt99XzSUVYU2MB:yD6e4jWzamo69tyL9Sd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b73f9c7af6a472d7ef55c7e344dc3cde_JaffaCakes118

Files

b73f9c7af6a472d7ef55c7e344dc3cde_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b0784f2189b637be1627f09d14ea297b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

netshell

NcFreeNetconProperties

ole32

CoCreateInstance
StringFromGUID2
CoInitializeEx
CoUninitialize
CoTaskMemFree

msvcrt

wcscat
wcslen
wcstoul
wcscpy

advapi32

RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW

kernel32

HeapAlloc
GetCurrentProcessId
GetSystemTimeAsFileTime

samlib

SamAddMemberToAlias

ntdll

NtAllocateVirtualMemory

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 15.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 941KB - Virtual size: 941KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE