c063a1e068ecfa16016b72c8944e33dd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c063a1e068ecfa16016b72c8944e33dd_JaffaCakes118
Size

128KB
MD5

c063a1e068ecfa16016b72c8944e33dd
SHA1

96f7e3e31f2a1eaace04bc08f63bc8edfd510020
SHA256

7d2c18bfcd7ad00b1149e5ba44c45dea4ebe54647faf9cc591e524fbfee98ad1
SHA512

a3dce1ff9db5a1900cc41a7c957860cf5316eb18cb0373283856e54a949fd4d7f23b269e6da0807dcfbb695ed44772acd29ebb5df9ca58be589dce4dd48a0874
SSDEEP

3072:m54JkVFNmWCnPz0QVqaPfpK06V9Par9QRrFAQqVaKdGcVp+k:m5TCnL5Vq4Jm4krFWVaKdzr+k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c063a1e068ecfa16016b72c8944e33dd_JaffaCakes118

Files

c063a1e068ecfa16016b72c8944e33dd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8404f6f8a6aa3be40afea968f26eb24b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

DuplicateTokenEx
CryptCreateHash
RegQueryValueExA
RegDeleteValueA
CryptReleaseContext
CryptGetHashParam
RegCloseKey

shlwapi

StrStrW
wnsprintfW
StrCmpNIA
StrCmpNIW
PathCombineW
wnsprintfA
PathRemoveFileSpecW
SHDeleteKeyA
wvnsprintfA
PathFileExistsW
wvnsprintfW
PathMatchSpecW
PathFindFileNameW

Sections

.rwx
Size: 38KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yzud
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xerot
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ