d504b2cfa6717ee9ad76ab26bf443e8b_JaffaCakes118 | Triage

Sharing

General

Target

d504b2cfa6717ee9ad76ab26bf443e8b_JaffaCakes118
Size

40KB
MD5

d504b2cfa6717ee9ad76ab26bf443e8b
SHA1

0e03d8ea349894b3c98ff6cfd924ed2d4bcf543e
SHA256

527584bd059291e7c7270288e15a87e3f9dfcce552ac3f192fb8b74cb209f630
SHA512

0830989425efc9607efea74b7ad8ed32ea830740d83122cdbaea00320654cabc3a0f20df21926b9834de33ba94c997623a66188ffc3bb7b993307012e8cdd7e5
SSDEEP

768:C9ux/Dj3A9z/Lm3L3GPTbKNDB/9MHjNtI9oGNTg9g:C9u1MV/ybkHKVXSjve

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d504b2cfa6717ee9ad76ab26bf443e8b_JaffaCakes118

Files

d504b2cfa6717ee9ad76ab26bf443e8b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

86a20e132186f5d4b1cd93767e71cae8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

memmove
labs
NtRequestWakeupLatency
RtlMultiByteToUnicodeSize
RtlUnicodeStringToOemString
ZwQuerySecurityObject
sqrt
NlsMbOemCodePageTag
LdrAccessResource
NtAccessCheckByTypeAndAuditAlarm
RtlDosSearchPath_U
sprintf

user32

LoadIconW
EnableWindow
GetFocus
CreateIconIndirect
LoadAcceleratorsW
FillRect
DestroyWindow
ChildWindowFromPoint
ClientToScreen
PostQuitMessage
BeginPaint
TrackPopupMenu

advapi32

AddAce
FreeSid
OpenSCManagerW
GetSecurityInfo
GetSidIdentifierAuthority
CloseServiceHandle
GetSidSubAuthorityCount
CopySid
GetLengthSid
QueryServiceConfigW
QueryServiceStatus
SetTokenInformation
EqualSid

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE