43255e8b9a190300c09f33ed31f32255_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

43255e8b9a190300c09f33ed31f32255_JaffaCakes118
Size

196KB
MD5

43255e8b9a190300c09f33ed31f32255
SHA1

d1381914260015112b80667d1e896febb8aa4749
SHA256

14b4fb0f1cd6c9212f2343b861ecb15d4dd066d75d26fa89ae63a4b1a3950753
SHA512

68af4ec4335d9cd3dc89cefcea368271ed283330a81d3067753a3ad0351f2ee4242c189a17f87595fd3ef83a8567bdd6505ed517d107648f71e19b190dce38b0
SSDEEP

6144:zTUOaXUSzqZ74PMOKEtHIQYRSR4/pZFYM:MO4pz/PMOvIkcZn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43255e8b9a190300c09f33ed31f32255_JaffaCakes118

Files

43255e8b9a190300c09f33ed31f32255_JaffaCakes118
.exe windows:5 windows x86 arch:x86

951861ed571b7eeb7db1aa5b95e7e6ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
LoadLibraryA
LCMapStringA
CloseHandle
CreateFileA
ExitProcess

user32

SetWindowLongA
CharLowerBuffA
CreateWindowExA
CloseWindow
wsprintfA

advapi32

RegOpenKeyA
RegCloseKey
RegDeleteValueA
RegEnumKeyA
RegQueryValueA
RegDeleteKeyA
RegCreateKeyA
RegSetValueA
RegEnumValueA

Sections

.text
Size: 179KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ