137443952009e86480e895a3ed09132d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

137443952009e86480e895a3ed09132d_JaffaCakes118
Size

333KB
MD5

137443952009e86480e895a3ed09132d
SHA1

7c06a189165f008b89274aa6b2a6555ea6162a33
SHA256

45e5b562a020c491328de6e37a6139d15be9dc51910ba76bc4ab38492a057240
SHA512

b6b238a3b1906967bf1bc30b6b0c40e7e3bf457d435e5dec956874aa1e223e88009191f77f9d104a2300c308410f6d1f7e1d9a79d05ebd988679da67473395ee
SSDEEP

6144:CO8AJq3PVqlBrGRHOe99rmxheA8NaBDxVxUpjvJB69g2TSHHU:+sq3dqlwulxheA8WCb23SH0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
137443952009e86480e895a3ed09132d_JaffaCakes118

Files

137443952009e86480e895a3ed09132d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

256d13be7e668cb92818aad25ac21ab1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsGetValue
GetThreadLocale
DeleteCriticalSection
CloseHandle
lstrcmpiA
HeapSize
GetStartupInfoA
VirtualProtect
CreateHardLinkA
SearchPathA
ExitProcess
AddAtomA
GetLastError
Sleep
ResumeThread
ReleaseMutex
GetTickCount
GetTempPathA
GetModuleHandleA
HeapDestroy
SetEvent

advapi32

RegCloseKey
CloseTrace
RegCreateKeyExA
LsaClose
CloseEventLog
RegEnumKeyExA
AccessCheck
LsaFreeMemory
RegLoadKeyA
GetFileSecurityA
OpenEventLogA
IsValidSid
FreeSid
LsaSetSecret
RegEnumValueA

urlmon

CoInternetParseUrl
CoInternetCompareUrl
HlinkGoBack
CoInstall
CoInternetGetSession

wtsapi32

WTSCloseServer

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ