d461e7515a574fca8f06c76b91a31109_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d461e7515a574fca8f06c76b91a31109_JaffaCakes118
Size

179KB
MD5

d461e7515a574fca8f06c76b91a31109
SHA1

f20488f38e2e12972e7477267194547675817268
SHA256

b35fcaf4b208ff17dd9702145bac5b10571930fc0e42a723e774828e906ca3d2
SHA512

6e8005ce6734be6369a6251fce2dc0e9d939d0a1068c2d28dc1c4de5d47315e641b49434f7698fbd63cf02b806e24f7c6cc7e42ebfad6bb701df77beb20700b9
SSDEEP

3072:YXST0TXJE9y0bp0zsuRVoEtwH5n8bsyxGhmGM7pLRkZPB0RQ5h/X:cFJEBV0/Vtw7yxGQsZ++5h/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d461e7515a574fca8f06c76b91a31109_JaffaCakes118

Files

d461e7515a574fca8f06c76b91a31109_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bac73716323e3bfd9f4b2dd5226fb5e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegSetValueExA

kernel32

VirtualAllocEx
CreateProcessA
MultiByteToWideChar
lstrlenA
EnumResourceNamesW
WideCharToMultiByte
GetSystemTimeAsFileTime
LocalAlloc
OpenWaitableTimerW
RaiseException
InterlockedExchange

shlwapi

PathFileExistsW

rpcrt4

NdrFixedArrayFree
UuidCreate

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ