38d3569d978c0ff979e25ece6ad88c8b_JaffaCakes118 | Triage

Sharing

General

Target

38d3569d978c0ff979e25ece6ad88c8b_JaffaCakes118
Size

160KB
MD5

38d3569d978c0ff979e25ece6ad88c8b
SHA1

ffad2bce64932e6180d9d9576250cc5df6272efd
SHA256

22ecf7f597e2002b1610bdeeae55b8b9ea82d6fe73c1da4a3d5c2593fdaa8c97
SHA512

783507e7f78eecf18a7a74e178beff1161e87c9e71c64bf418a4bee1ac4685e8e17a85d4d4b9165734820e8ea8bd09a6e0cf2d288f010e88dba4c703af8b7b51
SSDEEP

3072:fsPl2mXojIuNJ/oGNRsc4x9QC89oQW5WN3G3gz5LrqOoWVirVv6AFIOKGET8fP:OXojIu35NRBQTEwWNWw9COcVl+OKGp3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38d3569d978c0ff979e25ece6ad88c8b_JaffaCakes118

Files

38d3569d978c0ff979e25ece6ad88c8b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b959e89bcbd5fb1f4b12a79d9d3984e3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
CloseHandle
GetCurrentProcess
LoadLibraryA
CreateFileA
LCMapStringA

user32

SetWindowLongA
CloseWindow
CharLowerBuffA
wsprintfA
CreateWindowExA

advapi32

RegEnumValueA
RegCreateKeyA
RegOpenKeyA
RegEnumKeyA
RegQueryValueA
RegDeleteValueA
RegCloseKey
RegDeleteKeyA
RegSetValueA

Sections

.text
Size: 142KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ