eaf37d580c69d0d7463d8c10ebfa98a4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eaf37d580c69d0d7463d8c10ebfa98a4_JaffaCakes118
Size

282KB
MD5

eaf37d580c69d0d7463d8c10ebfa98a4
SHA1

9e8616b6a0870c48112832a64ac3eb7b0bc67908
SHA256

0d05e1631ba0880a790555c328da4a380973c163269417591ffc50b5e006b99b
SHA512

1c2e30276cf50f1a8c65e0ae423f09bc250c29a0ceb5b3a1f69b617e6accff6d7ffe594d043cad39f06589b877e8885b091cd1c40bf116704903af79274bc0b3
SSDEEP

6144:fzWM7nvPKzqfUSys+8CLVyVz/CgQSs+ENfFDmAZcrdsJdR0VJgsDC:brn3KYUSuoVzyFHcreJf0Pgsm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eaf37d580c69d0d7463d8c10ebfa98a4_JaffaCakes118

Files

eaf37d580c69d0d7463d8c10ebfa98a4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8d769b39cbfc844321ba9c5e9483fbd9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
Heap32First
VirtualProtect
WriteFile
VirtualFree
Sleep
VirtualAlloc
CreateFileA

user32

SendMessageA
GetMessagePos
GetInputState

wininet

InternetCloseHandle

ole32

CoUninitialize

advapi32

RegQueryValueA
RegQueryValueExA
RegEnumValueA

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 778B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 252KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE