191bf24a4913e7c26bf73203cc642599_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

191bf24a4913e7c26bf73203cc642599_JaffaCakes118
Size

224KB
MD5

191bf24a4913e7c26bf73203cc642599
SHA1

11a8c438b1df31ced41c3ced2eeb30d14da11152
SHA256

d769825006f02fe0627f9c85a450ccbb9d638a07dd7e5516f047a86716598068
SHA512

12912186d5f0f7997e005be461aed42b92034fd2edcddd11d4669d7623fd73164e1315d50c0cc23e035946577aedda92e9eec61b65ed39367e33a68ba705bbbf
SSDEEP

6144:h67WABqzYEQXPqi2EYLFapJL1BlpysY2o1oh:h65XPb2/8JL1/pysY5oh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
191bf24a4913e7c26bf73203cc642599_JaffaCakes118

Files

191bf24a4913e7c26bf73203cc642599_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6cf54e99ea60b01059488acbc9a35335

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
GetCurrentProcess
ExitProcess
LoadLibraryA
CreateFileA
LCMapStringA

user32

SetWindowLongA
CloseWindow
CreateWindowExA
wsprintfA
CharLowerBuffA

advapi32

RegDeleteValueA
RegOpenKeyA
RegSetValueA
RegEnumKeyA
RegDeleteKeyA
RegEnumValueA
RegCreateKeyA
RegCloseKey
RegQueryValueA

Sections

.text
Size: 125KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ