41e358ee3d66cfc9ca8939b4d9033d4d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

41e358ee3d66cfc9ca8939b4d9033d4d_JaffaCakes118
Size

87KB
MD5

41e358ee3d66cfc9ca8939b4d9033d4d
SHA1

5f22a8ceb03d63646956a2c41f07107249ecda10
SHA256

1a25d83fef9f6d761ab47a469ff7be3c03a05ce758968d89a194847ab643ee6e
SHA512

7ed1604289bdcd89fc3945443d57293c916eb00bbc22626535289315a9dca10aa922499eb3ebfa21cc81a8a628aa95b52b2a883c2fbff3f429b2c1d766eb8981
SSDEEP

1536:RuKZfphH7ttOutPwWsPzyKNwY5v3+fZtW6cXROcCRLZcqoS9tH+qUlTHaLd+:RlH7ttDEWKKCSIJXmZzjBUq+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41e358ee3d66cfc9ca8939b4d9033d4d_JaffaCakes118

Files

41e358ee3d66cfc9ca8939b4d9033d4d_JaffaCakes118
.exe windows:42457 windows x86 arch:x86

6199de30d61b6774d4d4b5aa6cdb4b95

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExA
FreeSid
RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExA
CloseServiceHandle
OpenThreadToken
GetLengthSid
RegOpenKeyExA
AddAccessAllowedAce
RegEnumKeyExW

kernel32

SetFilePointer
LoadLibraryA
DeleteCriticalSection
HeapAlloc
MultiByteToWideChar
lstrcmpiW
ExitProcess
GetModuleHandleA
VirtualAlloc

gdi32

CreateCompatibleBitmap
MoveToEx
LineTo
CreateCompatibleDC
GetTextMetricsW

user32

SetTimer
SetWindowTextW
IsWindowVisible
EnableMenuItem
MoveWindow
BeginPaint

shell32

Shell_NotifyIconW
SHGetSpecialFolderPathW
ExtractIconExW
ShellExecuteExW
SHGetFolderPathW
DragFinish
SHGetFileInfoW
DragFinish

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ