e7890524190be0caedd446e6b9c773dc_JaffaCakes118 | Triage

Sharing

General

Target

e7890524190be0caedd446e6b9c773dc_JaffaCakes118
Size

147KB
MD5

e7890524190be0caedd446e6b9c773dc
SHA1

a876eebcdec111e9ccd7604b410966ae489bf7ff
SHA256

e49c0ab1ad8b619d980b2d898ed29383b1b36b62753cf2f642db555de87d0096
SHA512

bd4298d002c516f8381d1bfc1f8a33c750f347be6db64d1085c6b667172f7d6bd4b781692832548e61c144d7aa9b2ccb1b743fc0cc391efe8d07bbe94db792e1
SSDEEP

3072:uBRwPjYvIEa7WBWhNqcPFRfDhNekfgx/kFj:uryjYQj7WIhwcN1XUsFj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
e7890524190be0caedd446e6b9c773dc_JaffaCakes118

Files

e7890524190be0caedd446e6b9c773dc_JaffaCakes118
.exe windows:5 windows x86 arch:x86

37990bee3e8b69258a4df7264376bbbc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryExW
GetModuleHandleW
lstrcatW
GetProcAddress
CreateMutexW
GetCommandLineW
GetWindowsDirectoryW
GetDateFormatW
CloseHandle
GetExitCodeProcess
GetVersionExA
WaitNamedPipeW
GetStartupInfoW
DeleteFileW
LoadLibraryA
ReadFile
InterlockedDecrement
FileTimeToSystemTime

advapi32

RegLoadKeyA
RegCreateKeyExA
RegDeleteValueA
RegRestoreKeyA
CryptSignHashW
RegOpenKeyW
OpenEventLogW
RegCloseKey
IsValidSid
LogonUserA

cryptdll

MD5Init
MD5Final
CDBuildVect
MD5Update
CDLocateRng

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE