338c1d060c709d79b8ddc7682c9bf5ed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

338c1d060c709d79b8ddc7682c9bf5ed_JaffaCakes118
Size

1.2MB
MD5

338c1d060c709d79b8ddc7682c9bf5ed
SHA1

bc3f318f62d60783ebac9343ccf8127f5e9892e5
SHA256

95564e08943512efee45c274a05c23fa0d2ce1d4a393152b046e03633f20121b
SHA512

25d1b2d76e651002cd55f4e582acb1acde69283874a7a2f218c98f5bc74a241f62da95044afad3961d91dd68c223a1ad90c3a2af9cfc17595ffca7a611190284
SSDEEP

24576:i9d+xCs2wZgT0nwAH4fm2+VoOn/c6Ud/dXt1uIoxU3Jhm:yApe0wa0b+1/c60B4xUZ4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
338c1d060c709d79b8ddc7682c9bf5ed_JaffaCakes118

Files

338c1d060c709d79b8ddc7682c9bf5ed_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0dbc2f7df8e42150f933b761db03fe8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
LoadLibraryA
LCMapStringA
ExitProcess
CloseHandle
GetCurrentProcess

user32

wsprintfA
CharLowerBuffA
CloseWindow
CreateWindowExA
SetWindowLongA

advapi32

RegSetValueA
RegEnumKeyA
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
RegEnumValueA
RegDeleteValueA
RegQueryValueA
RegOpenKeyA

Sections

.text
Size: 518KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 164KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ