244d161681714c3dfaf65e60911699bb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

244d161681714c3dfaf65e60911699bb_JaffaCakes118
Size

173KB
MD5

244d161681714c3dfaf65e60911699bb
SHA1

9c516f2bfc009ad31c6b90445a140154bd6fd5c0
SHA256

bc6bb9e0ca18d4fe35bd0ac146512d68cb706bbfd6be0a0956ba1d4113d5803d
SHA512

308577e0cbd97d2476374694c84ebd42487058f4aaf0028a3f604d6e61475032b88679df8b78c6958b1d8c4a9c5ff018e0e6eaea3c5c43a67a0ad7c61e570ab1
SSDEEP

3072:zGhFiY59R6GV256LqSFF2uK1RE2GbMj2heNBhFuDluZaWXvW3430bBsgiYNwREW:zGZ9R7HL23M2l2hejG8cuveXbGgiYu9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
244d161681714c3dfaf65e60911699bb_JaffaCakes118

Files

244d161681714c3dfaf65e60911699bb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f2ea16687bdd5032a4fb65b2fe1925bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
GetCurrentProcess
ExitProcess
LoadLibraryA
CreateFileA
LCMapStringA

user32

CharLowerBuffA
CloseWindow
wsprintfA
SetWindowLongA
CreateWindowExA

advapi32

RegEnumValueA
RegCreateKeyA
RegDeleteValueA
RegOpenKeyA
RegCloseKey
RegQueryValueA
RegDeleteKeyA
RegEnumKeyA
RegSetValueA

Sections

.text
Size: 124KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ