JaffaCakes118_6a8bfda086c859a169d0debd79b94dca | Triage

Sharing

General

Target

JaffaCakes118_6a8bfda086c859a169d0debd79b94dca
Size

197KB
MD5

6a8bfda086c859a169d0debd79b94dca
SHA1

bacc9890a0f2b07ddadd4cd28757acd673439eec
SHA256

04e2a1c24c85bc51299397b045611d82c2eb26f9bfc5b10fb68599fa809430df
SHA512

93f830488865a6628d0ab6a09ed981e6c3810901874fb3f2a7aeebfc85f81df2adc9dbbaf42cf611b977d782b494091c1d05595570ae5223783e8533ade29103
SSDEEP

3072:NVoZIGzoQMRKmneS8Z6aiFnAyskdZ+HSIh2xUxje8d8ya4bKnsu:NC/oVRKmneZ6xFnAy5d4yQFxjeVN4bK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_6a8bfda086c859a169d0debd79b94dca

Files

JaffaCakes118_6a8bfda086c859a169d0debd79b94dca
.exe windows:4 windows x86 arch:x86

26e9e44401e241288dd4e894af86ece8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

advapi32

RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

kernel32

VirtualAllocEx
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
EnumResourceNamesA
LocalAlloc
RaiseException
GetSystemTimeAsFileTime
OpenSemaphoreW
CreateProcessA
InterlockedExchange

rpcrt4

NdrFixedArrayFree
UuidCreate

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ