281df38c6bbdf8d55bd2d240b6a97977_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

281df38c6bbdf8d55bd2d240b6a97977_JaffaCakes118
Size

9KB
MD5

281df38c6bbdf8d55bd2d240b6a97977
SHA1

34092cb6bbecc7c480f305d3c2a8fe6ec9d3c177
SHA256

77fde7df5e0b92e422d50a4fec4d437320d48e06a152b7f37ee3c1df8a448312
SHA512

accf62b107dd35cc150689b2a9ad669dcb20170db78becdaf1c3d301f2cd86ca43e46610e1c1faa4f077bbc27f47dfd22a71d004468950db5cb4fd264d074621
SSDEEP

192:sFVvjjLwsRviU7q02CMj14KKFCDmbrkEWidyWzgkwS:sLXpiLhc5FVjWidyWzgpS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
281df38c6bbdf8d55bd2d240b6a97977_JaffaCakes118

Files

281df38c6bbdf8d55bd2d240b6a97977_JaffaCakes118
.exe windows:5 windows x86 arch:x86

51d1683864068a146c08e682a5a8826a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

y:\sdsrv\inetsrv\query\apps\filtreg\obj\i386\FiltReg.pdb

Imports

ntdll

_wcsicmp
_chkstk
wcslen
wcscpy
wcscat

msvcrt

__p__commode
__set_app_type
_except_handler3
_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
printf
__p__fmode

advapi32

RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW

kernel32

GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE