2849f1cf6f5cddcd21065deef05523a2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2849f1cf6f5cddcd21065deef05523a2_JaffaCakes118
Size

837KB
MD5

2849f1cf6f5cddcd21065deef05523a2
SHA1

5d8f83dc1de98263ed9b341f23b2b212d987943e
SHA256

63b92cb4dcf4dcf69fe8a42b86d58d1062230d652016a53a5ae687dd3efe654b
SHA512

3c1b1d1abe0e70681cab2092f9ff4ecea85ffc78c727ff73127bc4f283d35fdf8825f8d0bae47aead4650f083f64452ccac1dff2839e0b3bc179c18ba98e9009
SSDEEP

24576:4KLhjhARWPjmTIWRoufsHJnPP6x/9UXjxQki9:l2W7mTIWW2spnPP6Z9UXjs9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2849f1cf6f5cddcd21065deef05523a2_JaffaCakes118

Files

2849f1cf6f5cddcd21065deef05523a2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

023c7064daf616d7363ff3f88971bf68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
GetCurrentProcess
LoadLibraryA
LCMapStringA
ExitProcess
CreateFileA

user32

CharLowerBuffA
wsprintfA
CreateWindowExA
SetWindowLongA
CloseWindow

advapi32

RegCreateKeyA
RegSetValueA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegEnumValueA
RegOpenKeyA
RegQueryValueA

Sections

.text
Size: 512KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 192KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ