0a99bdbebe040b68e8d7a55745ba2a65_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a99bdbebe040b68e8d7a55745ba2a65_JaffaCakes118
Size

508KB
MD5

0a99bdbebe040b68e8d7a55745ba2a65
SHA1

062c64cf5565d67fd7fbf5bdfdd931509ff29bfa
SHA256

45700c970ac41398dd0dd88739680da66d2477bb8c8041def64a6377c5e4dc17
SHA512

0d41314f6d978114eadd4adc9a2b894d6b5e80e68f1d3e397a4a6b891c7422c89de11a879658fef2bb75d7a9ffda0e17e804762f3c9a4240207c3b73ec58f833
SSDEEP

12288:lX3paUAvvxZeQvFKDWtKx9s49dFlzKW3ISjdjU1DG3gt:t3X4JUQNwWtKx97RzKW35RjU1Dqw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a99bdbebe040b68e8d7a55745ba2a65_JaffaCakes118

Files

0a99bdbebe040b68e8d7a55745ba2a65_JaffaCakes118
.exe windows:5 windows x86 arch:x86

81580fd9181a40d4223b68ba501ebe8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
CreateFileA
CloseHandle
LCMapStringA
ExitProcess
GetCurrentProcess

user32

CharLowerBuffA
wsprintfA
CreateWindowExA
SetWindowLongA
CloseWindow

advapi32

RegOpenKeyA
RegSetValueA
RegCreateKeyA
RegQueryValueA
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA

Sections

.text
Size: 490KB - Virtual size: 492KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ