0cb27d799edff7638f2bafb0e6051fcc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0cb27d799edff7638f2bafb0e6051fcc_JaffaCakes118
Size

402KB
MD5

0cb27d799edff7638f2bafb0e6051fcc
SHA1

1ba89deffe24f378ec2d5724249e22a446d6b616
SHA256

c517a577c9dd6292d89ad9da86690d9917a828d83f0052efd7ce2420e4831c53
SHA512

79f4b12148e79e8382f78d32c87b7f94fe88548ec15835011de4a110bffd0ccbb81c4c25d3327b83d410969e74a2733854ed918b28e7f363dffeb2ca561d3c87
SSDEEP

6144:rSF5xcx8J5uybal9CTsnj/ThGmXruulVrLMgFgX4vKzA4+Y4g0iUWG0oqfFjgbN4:rO5qxKMybZqxXruulVvWX/rZ0HzqRgi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cb27d799edff7638f2bafb0e6051fcc_JaffaCakes118

Files

0cb27d799edff7638f2bafb0e6051fcc_JaffaCakes118
.exe windows:1 windows x86 arch:x86

0e4a543aef305172a1345e3a9f1065ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
CloseHandle
CreateFileA
ExitProcess
LCMapStringA
LoadLibraryA

user32

CharLowerBuffA
CreateWindowExA
wsprintfA
CloseWindow
SetWindowLongA

advapi32

RegDeleteValueA
RegQueryValueA
RegCloseKey
RegEnumKeyA
RegSetValueA
RegOpenKeyA
RegDeleteKeyA
RegEnumValueA
RegCreateKeyA

Sections

.text
Size: 4KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ