f4036003bde727c9e3eb743522791351_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f4036003bde727c9e3eb743522791351_JaffaCakes118
Size

273KB
MD5

f4036003bde727c9e3eb743522791351
SHA1

d547e2c31de0257afd341701eca294da5b0488cd
SHA256

77129669124fbc0e7457c2c0ca3f474f307ff6489b1f4ee56224a56e3a9c568c
SHA512

2e2a1ae6367ee6d0d28e7e1e575d11e282e76a53268f815159b285e46e2d2b9a38e607f62fc40c7ddfd94469f945cac65a9e9ab71ee83dd84379778370e3fc62
SSDEEP

6144:XBNvHPBbLWxV3bHmI4YNBXBaeQBroB9mcOJyX7dAGzd7:RNvHgjjYEXBOcOahAml

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4036003bde727c9e3eb743522791351_JaffaCakes118

Files

f4036003bde727c9e3eb743522791351_JaffaCakes118
.exe windows:5 windows x86 arch:x86

25af440cd19ff0e472c4afb67c6da83a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
LCMapStringA
GetCurrentProcess
LoadLibraryA
CloseHandle
CreateFileA

user32

CloseWindow
CharLowerBuffA
wsprintfA
SetWindowLongA
CreateWindowExA

advapi32

RegCloseKey
RegDeleteKeyA
RegOpenKeyA
RegDeleteValueA
RegEnumKeyA
RegQueryValueA
RegCreateKeyA
RegEnumValueA
RegSetValueA

Sections

.text
Size: 252KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ