2bf7585166adb4c64e2f74700a8f6baa_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2bf7585166adb4c64e2f74700a8f6baa_JaffaCakes118
Size

22KB
MD5

2bf7585166adb4c64e2f74700a8f6baa
SHA1

33bade34a8b566e13f8d04c4693c3ca26d1350b1
SHA256

f46cd4077849fdb3203e4c5c27c559af9d06d3918007adfd29da07799cc9dd2d
SHA512

35e0343fd42ab69b175077a91a45b67833d14acf65e8e25bb2fefdfe8e9d9d7c4b867e39c4af9d734b693e694ed3a1be14b364826d6690be97994ebde82ad34e
SSDEEP

384:SRPD3OFoNMZyyAsGPwg/zlMXaMd4s5NFqT2732rvLH/VRCTghtiGUQwE:27OF3ZyynD0MXaQNu27Gbr/CTgU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bf7585166adb4c64e2f74700a8f6baa_JaffaCakes118

Files

2bf7585166adb4c64e2f74700a8f6baa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1363ef0ad2827ba746220f8714593f56

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
QueryServiceConfigW
AddAccessAllowedAce
AllocateAndInitializeSid
LookupPrivilegeValueW
SetSecurityInfo
RegQueryValueExW
RegCloseKey

kernel32

SetLastConsoleEventActive
SetCommBreak
WaitForSingleObjectEx
GetThreadContext
DisableThreadLibraryCalls
IsBadStringPtrA
GetNamedPipeInfo

ulib

?Stricmp@WSTRING@@QBEJPBV1@@Z
?IsFMR@MACHINE@@QAEEXZ
?Strcspn@WSTRING@@QBEKPBV1@K@Z
?ResetBit@BITVECTOR@@QAEXKK@Z
?QuerySTR@BSTRING@@QBEPADKKPADKE@Z
??0LIST@@QAE@XZ
?IsYesResponse@MESSAGE@@UAEEE@Z
?Acquire@HMEM@@UAEPAXKK@Z
?MoveCursorTo@SCREEN@@QAEEGG@Z
?ModifyName@PATH@@QAEEPBVWSTRING@@@Z

user32

GetWindowPlacement
GetSysColorBrush
LoadImageW
SetClipboardData
OpenClipboard

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE