2a76e72a6c0d2d21a1988c0a1e5424d2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2a76e72a6c0d2d21a1988c0a1e5424d2_JaffaCakes118
Size

164KB
MD5

2a76e72a6c0d2d21a1988c0a1e5424d2
SHA1

63e229d078ecb2ba3140544bb0696d39e0ff52c7
SHA256

d3c81c72de9ca7e46f087d7db7245d82798a8ff3206a53490dd22abcbf3dde1a
SHA512

25de39a852092135863c439b9725f9345ceb7746fa7ee671d3470f4608c3bc5c1cf78004cddeb3cd71d9475c2e9012362b552325852429d6b7d9e0dbe68967bf
SSDEEP

3072:4Si7WzuXiRNIS4We8OtOmtZE4FzveYvHRfmMnJvw51ffM4c51zTZHf:/FDNIs0tOmBF9vHZNnJ81XQnZ/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a76e72a6c0d2d21a1988c0a1e5424d2_JaffaCakes118

Files

2a76e72a6c0d2d21a1988c0a1e5424d2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ca514bfb66cdd5260bd729cd7f7fecad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

P:\oIQnqAds\qMpWZZlCaEoMc\RrbwvyFa\cbuawVach\yFhzfGnknzDJs.pdb

Imports

kernel32

GetLocaleInfoW
ResumeThread
GlobalFree
FreeResource
QueryDosDeviceW
GetComputerNameExW
MulDiv

shlwapi

PathUnmakeSystemFolderA

advapi32

RegQueryValueExA
RegQueryValueExW
RegReplaceKeyA

user32

ShowCursor
SetCursorPos
GetTopWindow
IsWindow
GetClientRect
IsWindowUnicode
GetFocus
OffsetRect
MessageBeep

ntdll

RtlCompareMemory

Exports

Exports

?InsertFil

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fxc
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fx
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ