387be8d6f3315b740b1409f54c498536_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

387be8d6f3315b740b1409f54c498536_JaffaCakes118
Size

212KB
MD5

387be8d6f3315b740b1409f54c498536
SHA1

fcb87c19f0c2bd8e45e673f29e712b2d4b8863e4
SHA256

4ec18f8a1f4f2b2927ad637149b860ead2ff929595e08538191a4966135047db
SHA512

bfee55b7cd80972017a31e3c0de0df49c5b60fb537ad176a70b57dcec2d441c308fcd44ee9e52cb06e9d965cb79963498d345a9f968b4a8a8762159accf9a965
SSDEEP

3072:AzB6BTW2EEqS5CfPV0yM0rM9CwbfhSnIOvcb7JMeY0fzvUOdenPIOpfrzmiMKq+z:OyEayuCCsIGcb7JJYgvZMnPpYQq+ci

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
387be8d6f3315b740b1409f54c498536_JaffaCakes118

Files

387be8d6f3315b740b1409f54c498536_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5674d3b02b9aa80fcbbc60fdc7fd98eb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
GetCurrentProcess
LoadLibraryA
ExitProcess
CreateFileA
CloseHandle

user32

wsprintfA
CharLowerBuffA
CloseWindow
CreateWindowExA
SetWindowLongA

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueA
RegDeleteKeyA
RegEnumKeyA
RegEnumValueA
RegQueryValueA
RegOpenKeyA
RegDeleteValueA

Sections

.text
Size: 170KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ