022832cd1c7310b25d85853e03ef8a03_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

022832cd1c7310b25d85853e03ef8a03_JaffaCakes118
Size

554KB
MD5

022832cd1c7310b25d85853e03ef8a03
SHA1

2ae4f741d612ae35a7a196ae73566e5ed201e823
SHA256

dd02b996dc9914b49c66aa0ec9d4e4b1370f13453f2c2a99afd5fe24095aee2b
SHA512

a3ddf3024adb9f2c3a2eadc548ff7eb13a499e36686ad9ac6a3e480fffd818c01dae984a75e7357d07e00d49473d95dc8e3e6f98133c41417ff51c7d6597578e
SSDEEP

12288:ELJ0HW2VOtD56AljJIayxIwg+3W+vakFjSRWC+b:OJIu56sITyt+VjQWCu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
022832cd1c7310b25d85853e03ef8a03_JaffaCakes118

Files

022832cd1c7310b25d85853e03ef8a03_JaffaCakes118
.exe windows:5 windows x86 arch:x86

47192e0db0df123978ede98dd6a69de0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA
PathRemoveFileSpecW
StrStrW
wnsprintfA
wnsprintfW
StrCmpNIW
StrCmpNIA
PathMatchSpecW
PathFindFileNameW
PathFileExistsW
PathCombineW
wvnsprintfA
wvnsprintfW

advapi32

RegCloseKey
RegQueryValueExA
CryptReleaseContext
RegDeleteValueA
DuplicateTokenEx
CryptCreateHash
CryptGetHashParam

Sections

.spcb
Size: 39KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ixgb
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.epgzub
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ