3e30a058a74ecb6a1d621b5b75899d93_JaffaCakes118 | Triage

Sharing

General

Target

3e30a058a74ecb6a1d621b5b75899d93_JaffaCakes118
Size

169KB
MD5

3e30a058a74ecb6a1d621b5b75899d93
SHA1

17f138733f3fe6c58f87562a9f8cd7c716d6dc31
SHA256

69a4ca69e17a66043d69d5a09ba6c4380dc43082386ef283f1622ead33215e75
SHA512

172cd68c40def0043f12bc6b07bd39d95254b4612126ff1356e79db74d8eb2aacc7b9c4ee34e6fb5826685336b13e08ea81fdd4df8160fabe537114e4c5fb303
SSDEEP

3072:XJQC6OEp15ZrUmQrReMc9LbnLGIcbjFDI20+SqA6LsQKWiJjJQU6b6nd0UeHZHke:Xb6OEVZ8rc9LTLdc1DD0+SqA4sWCjJZA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e30a058a74ecb6a1d621b5b75899d93_JaffaCakes118

Files

3e30a058a74ecb6a1d621b5b75899d93_JaffaCakes118
.exe windows:4 windows x86 arch:x86

04ea21902847e0903012cb11a3556db8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindFileNameW
PathFileExistsW
wnsprintfA
SHDeleteKeyA
PathMatchSpecW
StrCmpNIW

advapi32

CryptCreateHash
CryptAcquireContextW
GetUserNameW
CryptReleaseContext
DuplicateTokenEx
RegDeleteValueA

kernel32

ReleaseMutex
GetModuleFileNameW
WaitForSingleObject
WideCharToMultiByte
lstrcatW
FindFirstFileW
VirtualAlloc
VirtualProtect
GetModuleHandleA

user32

CloseDesktop
GetIconInfo
GetWindowTextA
PeekMessageA
FindWindowExA
GetWindowLongA
GetCursorPos

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 171B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 247B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE