46daca0ffdc10ffa26ff7e279326e1ff_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

46daca0ffdc10ffa26ff7e279326e1ff_JaffaCakes118
Size

388KB
MD5

46daca0ffdc10ffa26ff7e279326e1ff
SHA1

5a644747dace40bf604090c766a74d566df0cceb
SHA256

acebeef77ba3c7f7e294c5aeb274844371c905f249095fb0d6db5f64e943d736
SHA512

5ddcc86f62d7d76d33b26388ed4a49beeaced5ffb361cd3cfdfcb7e34ea83858d09e74e88a57d408bc8666ca628f82b84a04396767edf09178cc8b78c165aab5
SSDEEP

12288:LoKXf07/V4HpWXhQ4XuTTXs8RVHPHZiiIN/O:HXc1XhQ4+TjXVvHkB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46daca0ffdc10ffa26ff7e279326e1ff_JaffaCakes118

Files

46daca0ffdc10ffa26ff7e279326e1ff_JaffaCakes118
.exe windows:4 windows x86 arch:x86

35855782233b8b8f3518d84c78554eac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
VirtualQuery
LoadLibraryA
GetTickCount
RtlUnwind
GlobalUnfix
QueryPerformanceCounter
GetCurrentProcess
GetProcAddress
VirtualAlloc
GetCurrentThreadId
SuspendThread
HeapReAlloc
HeapAlloc
LocalLock
GetSystemTimeAsFileTime
HeapFree
InterlockedExchange
GetModuleFileNameA
TerminateProcess
GetModuleHandleA
ExitProcess

advapi32

RegNotifyChangeKeyValue
CryptDecrypt
RegRestoreKeyA
CryptSetProvParam
StartServiceW

user32

TileChildWindows
GetMonitorInfoW
ShowCaret
AdjustWindowRect
CallMsgFilterW
CharNextExA
CharUpperBuffA
CreateDialogIndirectParamA
ValidateRect
PostThreadMessageA
GetWindowDC
AppendMenuA
RedrawWindow

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ