3e1a24ad3503688164d7afc341e1c44c_JaffaCakes118 | Triage

Sharing

General

Target

3e1a24ad3503688164d7afc341e1c44c_JaffaCakes118
Size

267KB
MD5

3e1a24ad3503688164d7afc341e1c44c
SHA1

72268e0654b423e15f64b4d5106fb71bccced5e9
SHA256

e4fd5a8f385b469484e8ee2dd56bc19f694b6bc2a82f62a8c41642979c2aaffb
SHA512

82a576870565dfbb54ef6add84aed3cff31efb5339410640cd38b624864302403526f232486175e808c46ca37006d51aef0dcb099f49af07cdcd0a6f837c3655
SSDEEP

6144:x4YvTJUxcx8J5uybal9CrSSlKIZEgI9WhTh:EqxKMyb1SSlKsEgCe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e1a24ad3503688164d7afc341e1c44c_JaffaCakes118

Files

3e1a24ad3503688164d7afc341e1c44c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

05a09782e442b7d520fd45f62ab8fb61

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
GetCurrentProcess
CloseHandle
CreateFileA
LoadLibraryA
ExitProcess

user32

CharLowerBuffA
CreateWindowExA
SetWindowLongA
CloseWindow
wsprintfA

advapi32

RegCloseKey
RegDeleteValueA
RegEnumKeyA
RegCreateKeyA
RegOpenKeyA
RegSetValueA
RegDeleteKeyA
RegQueryValueA
RegEnumValueA

Sections

.text
Size: 4KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ