0f3aa72a1c12138ca87e287e13cbce1d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f3aa72a1c12138ca87e287e13cbce1d_JaffaCakes118
Size

624KB
MD5

0f3aa72a1c12138ca87e287e13cbce1d
SHA1

df973487809a6e8dd39b3f64f178eadf242c3098
SHA256

2c510730ab71cecde6f5c898e896e704915416935fe3f02ead0963a257d7aa7a
SHA512

92862928c9a9168e787c69fd754daaf471eb89cdebdc0d5695767aeb853aa087f6501653852cb08a0ae9b6236af7634a9c9bc4bb01e987d427c99aa411e008db
SSDEEP

12288:UloCnk9kDnUhkJL3Bqecxw4fl1OFnwxXSl4tZ9lbMB0ZGYQh6:/CE+skJL35W11OFWSLyZn/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f3aa72a1c12138ca87e287e13cbce1d_JaffaCakes118

Files

0f3aa72a1c12138ca87e287e13cbce1d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f0d3a9bffd93d50231b29cb2e2efb3ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
GetCurrentProcess
LCMapStringA
LoadLibraryA
CloseHandle
ExitProcess

user32

CreateWindowExA
SetWindowLongA
CloseWindow
CharLowerBuffA
wsprintfA

advapi32

RegDeleteValueA
RegCloseKey
RegOpenKeyA
RegEnumKeyA
RegSetValueA
RegDeleteKeyA
RegQueryValueA
RegEnumValueA
RegCreateKeyA

Sections

.text
Size: 563KB - Virtual size: 564KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ