37709796a185e8bd51366eb5306a494b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37709796a185e8bd51366eb5306a494b_JaffaCakes118
Size

188KB
MD5

37709796a185e8bd51366eb5306a494b
SHA1

44ea5e0fd63c803367f22dc0e5ea1419612b39c2
SHA256

a8f444b937a757ce9469ed8f24984fa1cdf1b1a0ecdf03606e6e6efd476d29b9
SHA512

b64857ec119efc1a39cb66c89201dd92c8de6dc08cf31e145757bafeaea34d7797e1501b4d5cb7f019ac8eb9dbb40147eb4ff7c5643f06e0c6c94426db263016
SSDEEP

3072:RBE7/wP4E4ioYFLI99C/Fr1KONgV/DSbUWgiaj37bA5ve19GFCoyXBuWzZT4:RBE7A94OLS9E1KbV/4g5L7U5ve1ZoyX0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37709796a185e8bd51366eb5306a494b_JaffaCakes118

Files

37709796a185e8bd51366eb5306a494b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f679c5fd06e7017b04db65a659f6c031

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
CloseHandle
ExitProcess
CreateFileA
GetCurrentProcess
LCMapStringA

user32

SetWindowLongA
CloseWindow
wsprintfA
CharLowerBuffA
CreateWindowExA

advapi32

RegEnumValueA
RegCreateKeyA
RegEnumKeyA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueA
RegOpenKeyA
RegCloseKey
RegSetValueA

Sections

.text
Size: 168KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ