0f9d6b4561a0f140beb26c0fa73071db_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f9d6b4561a0f140beb26c0fa73071db_JaffaCakes118
Size

1.6MB
MD5

0f9d6b4561a0f140beb26c0fa73071db
SHA1

93a1d1d35b7b00b2393002df8e0dccd326dce281
SHA256

41ca6ef5b85be71a53f73ece938b3170eab85eae8293021055f680f46a8c4641
SHA512

e9cc5e443c3b10baba609268279e0252038f1853d7610e8e81e5e64b7ac2e0264c04b08e76d09d838be9e5de8621298d520462aa3daae877b3a80201a01370f2
SSDEEP

24576:qd8HuYhYVBFdJv6zSvf6IuEnb/vLYeCa5SLtR1AynG/:RufrRv6i5brKIShR1AynG/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f9d6b4561a0f140beb26c0fa73071db_JaffaCakes118

Files

0f9d6b4561a0f140beb26c0fa73071db_JaffaCakes118
.exe windows:4 windows x86 arch:x86

36f196299dd1bb32d12aef39ed41ec2f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
ExitProcess
LoadLibraryA
CreateFileA
CloseHandle
GetCurrentProcess

user32

CloseWindow
SetWindowLongA
wsprintfA
CreateWindowExA
CharLowerBuffA

advapi32

RegEnumValueA
RegCloseKey
RegCreateKeyA
RegEnumKeyA
RegSetValueA
RegDeleteValueA
RegQueryValueA
RegOpenKeyA
RegDeleteKeyA

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size:

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ