2f8ed960441bcbd8acf1f56f9fece2c2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f8ed960441bcbd8acf1f56f9fece2c2_JaffaCakes118
Size

65KB
MD5

2f8ed960441bcbd8acf1f56f9fece2c2
SHA1

95e70bfc33b79fc25d73f0f88acc7e5e763ae99c
SHA256

ecf8051a64460b903c85dc1bda28bec47680f66f108393b358913e2504b7a60f
SHA512

3ab585056a15d8e6a1ca4c289247b68e90ca2b03306d827c17badeaba827a0fc650166f4422ab38362b9cc32d00e899c4f3738ce381df67d60d167783abff3c7
SSDEEP

1536:F8Mtg7d47mmd5iEH/c8fXIGCS/nyWK9k:FTg7eOgzIEnrK6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f8ed960441bcbd8acf1f56f9fece2c2_JaffaCakes118

Files

2f8ed960441bcbd8acf1f56f9fece2c2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a0636c5490f52f4e551542e03592cbcc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetFileAttributesA
VirtualAlloc
Sleep
GetSystemTimeAsFileTime
CreateFileA
GetTimeZoneInformation
GetLocalTime
FindClose
lstrcmpiW
ResetEvent
FindNextFileW
ReleaseMutex
EnterCriticalSection
GetLastError
SetFilePointer
SystemTimeToFileTime
GetFileTime
CreateMutexW
lstrlenA
lstrcmpiA

advapi32

RegCloseKey
RegQueryValueExA
RegEnumKeyExA
CryptReleaseContext
CryptCreateHash
DuplicateTokenEx
CryptGetHashParam
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
CryptAcquireContextW
GetUserNameW
CryptHashData
CryptDestroyHash

user32

GetClassNameA
CloseDesktop
ExitWindowsEx
SendMessageA
ToUnicode
FindWindowExA
OpenWindowStationA
GetDlgItem
GetKeyState
EndDialog
CharLowerBuffA

shlwapi

wvnsprintfW
StrCmpNIW
wvnsprintfA
StrCmpNIA
wnsprintfA
PathFindFileNameW
PathRemoveFileSpecW

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE