17ae41cb1f1d2cbf356291d3fe9f3660_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17ae41cb1f1d2cbf356291d3fe9f3660_JaffaCakes118
Size

169KB
MD5

17ae41cb1f1d2cbf356291d3fe9f3660
SHA1

6a6b3cc7c24305dec192542518483bf921fdb7f7
SHA256

681572dc33dec4a4ee0c49ad18c9598ef7c0288c003121d48f5b0bd87686de42
SHA512

01fd2d5f0123cce4c622213e394c362d8c8c2a109074828ce9fe602649e697fd349f6c6b68617654e29b60831d08f21195588f453d464d45972b9156c66d9640
SSDEEP

3072:YCV8hSAVC2ojRTlRqNZXYv3sUhIBhGq4f6HIcvE/b+U9MGfIAI5QgZpBKfgRDAVl:YCO5CjLSfdBhGq4yocubhLI75JZbK0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17ae41cb1f1d2cbf356291d3fe9f3660_JaffaCakes118

Files

17ae41cb1f1d2cbf356291d3fe9f3660_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fa2aeba74ebb41026eb6f4b7d6370f9a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetIpAddrTable

setupapi

CM_Get_Parent
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

shell32

SHGetFolderPathW

mprapi

MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName

kernel32

FreeEnvironmentStringsA
AddAtomA
UnhandledExceptionFilter
GetEnvironmentStringsW
WriteFile
FreeEnvironmentStringsW
GetOEMCP
EnumResourceLanguagesA
GetCPInfo
GetNumberFormatA
GetEnvironmentStrings
GetStartupInfoA
SetUnhandledExceptionFilter

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

IsWindow
CreateWindowExW
GetDlgItem
SendMessageA
EnumChildWindows
DestroyWindow
GetWindowThreadProcessId

Sections

.text
Size: 89KB - Virtual size: 484KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ