2e2d6bf2bafa908309c6c5b5f37b9023_JaffaCakes118 | Triage

Sharing

General

Target

2e2d6bf2bafa908309c6c5b5f37b9023_JaffaCakes118
Size

186KB
MD5

2e2d6bf2bafa908309c6c5b5f37b9023
SHA1

42819bd6d52e3d6a36ff2ee25ce6695ac002fbfb
SHA256

6fe8d0596afe92587560ead34cc5e7639c17b140e04ae64eef797e9eff65699b
SHA512

95fb84449b462f46cffd9d6c96b958cb061c57d6195602ab550109b9557808d339ceddd56f91dba97b4b21a53d8640ac553e3c261833f481c0673d2b865ad99b
SSDEEP

3072:+OGyS8TVnYhLEhQ8tWrvyfzBQndGCLXYcmyMRjRnJyc1vqGeIXAMJZrN:+OGy1RYZEhQ8UyfzBQdGCLKbRj9UCCoh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e2d6bf2bafa908309c6c5b5f37b9023_JaffaCakes118

Files

2e2d6bf2bafa908309c6c5b5f37b9023_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9dd9d658094a3d35f5d3d4a922ad7d9e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

NdrFixedArrayFree
UuidCreate

kernel32

VirtualAllocEx
MultiByteToWideChar
RaiseException
WideCharToMultiByte
EnumResourceNamesW
CreateProcessA
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
OpenWaitableTimerW
InterlockedExchange

advapi32

RegCreateKeyExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

mprapi

MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName

shlwapi

PathFileExistsW

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ