28a7e79bfd5d3316211dcc06fc087342_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28a7e79bfd5d3316211dcc06fc087342_JaffaCakes118
Size

268KB
MD5

28a7e79bfd5d3316211dcc06fc087342
SHA1

a3447bb11c405c0957bb57de2a24a4226e7eeed5
SHA256

6d47f46213c68a98bc7de2c2ae4c7509427adf30af07d2c115434c555b9461e6
SHA512

558e2474b7bb4bfb120330fe54f0c65c9bb6026bcc21661e24e66d1a7b2aa127dc19fd3a44c8bd441c7cb02ebbf070630019c5634264820e470fe28f1917b4f2
SSDEEP

6144:hLLThLIP9UvqGAHgc1c52Fg37kNL+ORg2oUqav28UkRP8+D7:NCUCHgc1hFgLwqORhR+8U4/D7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28a7e79bfd5d3316211dcc06fc087342_JaffaCakes118

Files

28a7e79bfd5d3316211dcc06fc087342_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6f6b6cf882b645d6df731a8cf60fab23

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
CloseHandle
CreateFileA
LCMapStringA
ExitProcess
GetCurrentProcess

user32

CloseWindow
wsprintfA
CreateWindowExA
SetWindowLongA
CharLowerBuffA

advapi32

RegQueryValueA
RegDeleteValueA
RegCreateKeyA
RegSetValueA
RegOpenKeyA
RegCloseKey
RegDeleteKeyA
RegEnumKeyA
RegEnumValueA

Sections

.text
Size: 235KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ