2b1c8928ce99271807152e91c32db7ba_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2b1c8928ce99271807152e91c32db7ba_JaffaCakes118
Size

46KB
MD5

2b1c8928ce99271807152e91c32db7ba
SHA1

2a1a5d31df51bc0753ba3c4675f102f33c99a1ae
SHA256

40ed44c57ef6965c122de7db15585542f55224bff9da3c91c8447a20e052cec8
SHA512

b6be5bfb2439d718f6e812de145508b363ef5d90a5b4593a06b8342a326559396ae5851ce301529f95baec794bf005cfa16086cd95314e0e7ea35706a18bdc92
SSDEEP

768:8toanVpBAJ6MugB88xYKR9r4lJ3FyLdf6ZlUJ/6e0ZAThCSXYzzLS+Ey+LPdjL89:83p0PgS4lJ3dRe0ZCCxTS6+T5L7fIL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b1c8928ce99271807152e91c32db7ba_JaffaCakes118

Files

2b1c8928ce99271807152e91c32db7ba_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c9ea2b9ad1b1d328d1edb42b592f66d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
FreeResource
VirtualAlloc
VirtualFree
GetProcAddress
FindResourceA
SizeofResource
LoadResource
LockResource
AddAtomA
GetModuleHandleA
FindAtomA

user32

VkKeyScanA
ValidateRect
UnregisterHotKey
ValidateRgn
UnregisterClassA
UnionRect
TranslateMDISysAccel

advapi32

CryptHashData
RegDeleteKeyA
RegSaveKeyA
RegEnumKeyA
CryptSetHashParam
CryptExportKey
RegQueryValueExA
CryptCreateHash
RegDeleteValueA
CryptSetKeyParam
RegCreateKeyA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 882B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 103B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ