4c38920e4291b8630ed8065e4c960005_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4c38920e4291b8630ed8065e4c960005_JaffaCakes118
Size

205KB
MD5

4c38920e4291b8630ed8065e4c960005
SHA1

31b6a539fca89d78812e28ed9d99aef8497ce292
SHA256

28106f3c1e92f039d6737d929eb6c8df4a22763cc507a6edd83f9744a0a558b1
SHA512

03452aabaf02ea957571dce5efc3489df0904645072d81f87cb98bd4b5bc2c95e2d57b7efdafcc81f91c4f88730b5026b5dd538ffa75b9f98d11de7be3d99fae
SSDEEP

3072:Td9nlxbgm3BYwL3jcrMIlRhGOoB4t0vhGHA470wb91ojcLmQ7:Td7xbgmpQrxhGO+JIg47tb91wg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c38920e4291b8630ed8065e4c960005_JaffaCakes118

Files

4c38920e4291b8630ed8065e4c960005_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a458031ac057f8b735f96c40ff93fa90

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
LoadLibraryA
LCMapStringA
ExitProcess
CreateFileA
CloseHandle

user32

wsprintfA
CharLowerBuffA
CreateWindowExA
CloseWindow
SetWindowLongA

advapi32

RegDeleteValueA
RegEnumValueA
RegCreateKeyA
RegCloseKey
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegSetValueA
RegOpenKeyA

Sections

.text
Size: 150KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ