d20db906eb215b85cf52722636e9fdfb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d20db906eb215b85cf52722636e9fdfb_JaffaCakes118
Size

560KB
MD5

d20db906eb215b85cf52722636e9fdfb
SHA1

259cd2d0cba32f509585f32102fe79572fb6f0ea
SHA256

7781a4260f25a5d27d29e44503a6f78e377150dff42a0139eca72abfe7509f20
SHA512

b4f99e8de80fdc09eea08b08d9cc51bc9df242667e1a927f8c0b1de5a5e2eb0ef5270b91bd72909c2b218764f3effc9ed5451fff6f8ee39eb439d4d39318ae1f
SSDEEP

12288:sgllIEev++BzVnCMi2v1AvKZVh12Psc3nRJQcHflWl:PlCEeCMLAG52PX/QkfUl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d20db906eb215b85cf52722636e9fdfb_JaffaCakes118

Files

d20db906eb215b85cf52722636e9fdfb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

765f9021183d27c0bdadd23d5abeb877

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA
PathMatchSpecW
wvnsprintfA
wvnsprintfW
PathFileExistsW
PathRemoveFileSpecW
wnsprintfW
PathFindFileNameW
PathCombineW
StrCmpNIW

kernel32

GlobalUnlock

advapi32

RegDeleteValueA
CryptDestroyHash
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
CryptGetHashParam
RegQueryValueExA
RegCloseKey
CryptAcquireContextW
CryptHashData

Sections

.obopcz
Size: 44KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qbcnar
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rcfix
Size: 6KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ