c0843af52abe778c6d3e42f26c80016f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c0843af52abe778c6d3e42f26c80016f_JaffaCakes118
Size

458KB
MD5

c0843af52abe778c6d3e42f26c80016f
SHA1

3740dfd0d0638eaf632c31cdbc16c70d5bdc3019
SHA256

9d18979afce673d5b342a3abcc2d965310b49fb5c2d0cd88be91ab93911b4454
SHA512

1d9b3eb98f0796c4544f4231ae6f215aaf9f460741af3e541adddadb0adf957a71a3a8403b66c95b2ecc1da712509f023f5bc8e73491987496be6b755d4ae697
SSDEEP

12288:CKZUuF9cX8g9LOzT/oi40OugFQusskzaLUow:CKZUuF9cX84cWLqPzaPw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0843af52abe778c6d3e42f26c80016f_JaffaCakes118

Files

c0843af52abe778c6d3e42f26c80016f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fd7c3cb59d106104c2c83e2d62ccc438

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrW
PathFindFileNameW
wnsprintfA
wvnsprintfW
PathCombineW
wvnsprintfA
PathFileExistsW
SHDeleteKeyA
PathMatchSpecW

kernel32

GetModuleHandleA

advapi32

CryptReleaseContext
RegQueryValueExA
CryptGetHashParam
CryptCreateHash
RegDeleteValueA
RegSetValueExA
CryptDestroyHash
DuplicateTokenEx
GetUserNameW
CryptHashData
RegCloseKey

Sections

.mlinwv
Size: 41KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lij
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xgtat
Size: 6KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ