056ac6ceccd0d1fa271e1e2b74a53be8_JaffaCakes118 | Triage

Sharing

General

Target

056ac6ceccd0d1fa271e1e2b74a53be8_JaffaCakes118
Size

10KB
MD5

056ac6ceccd0d1fa271e1e2b74a53be8
SHA1

013816a004daf64f7502d5a306b6b8d0696ee693
SHA256

38ffbc64341db01d52e60478c9645d4020107ce114aefca171cca0d8160dae82
SHA512

6d543a2f947c64a80106b10dd6978cc935cb00d5322bc6f3e20f9d7df8a64ef71851228e87334cce955354cfc3daeb16fbdf41c62cf293631e692c8c4523287e
SSDEEP

192:a9TKnJ/+kuauSwNE5/QuKFXI+D1lY0czZz9PXHMBJ:aUnJ/+n/EkXVfczd9PcBJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
056ac6ceccd0d1fa271e1e2b74a53be8_JaffaCakes118

Files

056ac6ceccd0d1fa271e1e2b74a53be8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

af40851724faa1d3d933e8f709ea22c8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crtdll

memset
strlen
memcpy

kernel32

GetModuleHandleA
HeapCreate
OpenFile
GetFileSize
GlobalAlloc
ReadFile
CloseHandle
GetSystemDirectoryA
CopyFileA
GetComputerNameA
GetProcAddress
CreateProcessA
CreateRemoteThread
Sleep
GetProcessVersion
OpenProcess
HeapDestroy
ExitProcess
VirtualAllocEx
WriteProcessMemory
InitializeCriticalSection
GetModuleFileNameA
HeapAlloc
HeapReAlloc

user32

FindWindowA
GetWindowThreadProcessId

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetUserNameA

Sections

.code
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.flat
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE