2a6b9655afb21825dd13250b47511d91_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2a6b9655afb21825dd13250b47511d91_JaffaCakes118
Size

209KB
MD5

2a6b9655afb21825dd13250b47511d91
SHA1

d3020a643bc269fec7d55bc0432cef9df92d3db9
SHA256

4137f1845690719268c90d5b743f5b62cad10411285331e4f4cae4e974bbd452
SHA512

ece8ffc2643b75bb1898f73fa4ec9868793b94ac8de5235f5b2cfc188f0db4d65486e7573a339ddb45ff5f88666ce242297421c750acc1f074e229df2fb2fd05
SSDEEP

3072:7EMqlLcvmwPAfqr49GXWfRt5I3wPfkpzYE6qEZPSg494gZfY:gMqlLcH2q4PpPgzgqEZPP4RZw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a6b9655afb21825dd13250b47511d91_JaffaCakes118

Files

2a6b9655afb21825dd13250b47511d91_JaffaCakes118
.exe windows:4 windows x86 arch:x86

62a98ccf3b1fbaff7fb444c6b2428b5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
GetCurrentProcess
CloseHandle
LoadLibraryA
CreateFileA
ExitProcess

user32

wsprintfA
CreateWindowExA
CloseWindow
CharLowerBuffA
SetWindowLongA

advapi32

RegCloseKey
RegDeleteValueA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegSetValueA
RegCreateKeyA
RegEnumValueA
RegDeleteKeyA

Sections

.text
Size: 164KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ