28c6a7c8674bd62dce02dcc16039f86e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28c6a7c8674bd62dce02dcc16039f86e_JaffaCakes118
Size

160KB
MD5

28c6a7c8674bd62dce02dcc16039f86e
SHA1

46a332d0d17dd3e6f9d7299050a137c54e779dbb
SHA256

0ede8a93ba5694238dda3027771b24312c4221b90a7cc3edd70f7bea97e8b809
SHA512

73f5ab25603eff96733c1eb23cf1df5377e66748c93da9e14bed4d6a23e326720932c192864f67fa5763054129f94ed8bf3bcf01221f32fa4a99e791cf1f3bcf
SSDEEP

3072:s81zZ/tdalHJOY+xsf91qPbjl2cgd2Bj+ZgNlWY9cRxhfin+cBx1v5piT:sIzipdCsf3qDx1t/NgLRxpin113iT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28c6a7c8674bd62dce02dcc16039f86e_JaffaCakes118

Files

28c6a7c8674bd62dce02dcc16039f86e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6d09695ff95205065cfc50e6f3197d3d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
CloseHandle
GetCurrentProcess
CreateFileA
LoadLibraryA
LCMapStringA

user32

CharLowerBuffA
CloseWindow
wsprintfA
SetWindowLongA
CreateWindowExA

advapi32

RegEnumValueA
RegOpenKeyA
RegEnumKeyA
RegCreateKeyA
RegQueryValueA
RegDeleteValueA
RegSetValueA
RegCloseKey
RegDeleteKeyA

Sections

.text
Size: 143KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ