cec08469fd68fc14de81567c4d4acd18_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cec08469fd68fc14de81567c4d4acd18_JaffaCakes118
Size

29KB
MD5

cec08469fd68fc14de81567c4d4acd18
SHA1

ddf2fc7529fd25d946d316ec0bafefbf27a960c1
SHA256

e76490f41a633a4c6f18807a4368e3e7f9fae298f063943ffe5b48314aaa583b
SHA512

a13c28802cc7de2e506b1bbb5277a2d39612eb264f3a0f5adf670fa72e048f7ad31d52acaf95db841b1db245bb22055b522e3abc981637f9d2cbc50bb503e4cf
SSDEEP

768:hPsoIhkWIycpy4cJnSK5YtgR6qk64DVuaSj:h0YWIyWEnSK+SR6nzDVZSj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cec08469fd68fc14de81567c4d4acd18_JaffaCakes118

Files

cec08469fd68fc14de81567c4d4acd18_JaffaCakes118
.exe windows:3 windows x86 arch:x86

e3dc3dfc6a7e89e9134b39582b34c316

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

RegenerateUserEnvironment
ShellHookProc
DragQueryPoint
DragQueryFileA
SheShortenPathA
SHBrowseForFolderA
RealShellExecuteA

kernel32

GetLocaleInfoW
SetProcessShutdownParameters
IsBadStringPtrA
GetSystemWindowsDirectoryW
WideCharToMultiByte
GetStringTypeW
LocalSize

advapi32

GetAclInformation
GetOverlappedAccessResults
LookupAccountNameA
GetCurrentHwProfileA
RegOpenKeyA
LogonUserA

msvcrt

_read
__p__wpgmptr
_wchmod
_onexit
_wcsncoll
iswascii
sin

gdi32

CreatePenIndirect
EqualRgn
GetCurrentObject
GetCharWidthFloatW
ExtCreateRegion
SetFontEnumeration

Sections

.text
Size: 4KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE