41515265e49367cf6006b8ef0d9c3a59_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

41515265e49367cf6006b8ef0d9c3a59_JaffaCakes118
Size

192KB
MD5

41515265e49367cf6006b8ef0d9c3a59
SHA1

ccff68d46173fee4cd8378da9ef3ccb7e988736b
SHA256

a0cf4e79bd6f780df21ec4f56e66cf689deff94e3fff5946e30e1d5a4c2518cd
SHA512

2dea48fac8a7dbca4f0c24f44389572a8d619bf5fafb42ceeea49364ec191b2928ec113101c10c50fb29f3c267df2e74767dcd1e26a01cf6402317657ba8ca0d
SSDEEP

3072:A8Jh4oS01grJGkUbWRvNvfhkQ86ymYoSk92NjmiskFogZfY+:A8Jhdr1GAJbOvN3WooN/skFDZw+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41515265e49367cf6006b8ef0d9c3a59_JaffaCakes118

Files

41515265e49367cf6006b8ef0d9c3a59_JaffaCakes118
.exe windows:4 windows x86 arch:x86

58636acd87db84e7e595f125707b5e3a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
LoadLibraryA
ExitProcess
CreateFileA
GetCurrentProcess
LCMapStringA

user32

wsprintfA
CloseWindow
CharLowerBuffA
SetWindowLongA
CreateWindowExA

advapi32

RegDeleteKeyA
RegCreateKeyA
RegCloseKey
RegEnumKeyA
RegEnumValueA
RegQueryValueA
RegDeleteValueA
RegOpenKeyA
RegSetValueA

Sections

.text
Size: 149KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ