f60b45370a0377b3f1c13c7ae03c7472_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f60b45370a0377b3f1c13c7ae03c7472_JaffaCakes118
Size

400KB
MD5

f60b45370a0377b3f1c13c7ae03c7472
SHA1

6e4a95155af39a2047c5020345d29375077044c2
SHA256

fcd91e5358e0414e177d5701450799ed45c360db42ddb00f4eb8b0684f996c31
SHA512

bfdf74b6a28fcc6f7bf75ed3c517c1db0435ae86534248c4957d8d2c1388f36b06abcb676db85864ca853e34090064c3c19c5996f2c2aa197f2b4ae338c3d51d
SSDEEP

12288:YSUs7QGhLPqiwE8p3Cvv2NkZ8+SXsfVgX8y90m:YSUs0Ev8p3yuNk++8sSX8y3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f60b45370a0377b3f1c13c7ae03c7472_JaffaCakes118

Files

f60b45370a0377b3f1c13c7ae03c7472_JaffaCakes118
.exe windows:6 windows x86 arch:x86

32dee27e527d2f5e60f22031c3855b81

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
ExitProcess
LCMapStringA
LoadLibraryA
CreateFileA
CloseHandle

user32

wsprintfA
CharLowerBuffA
CreateWindowExA
CloseWindow
SetWindowLongA

advapi32

RegEnumKeyA
RegEnumValueA
RegCreateKeyA
RegDeleteValueA
RegQueryValueA
RegDeleteKeyA
RegSetValueA
RegOpenKeyA
RegCloseKey

Sections

.text
Size: 305KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ