5c0fc3302db465639467e0ba1878b02c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5c0fc3302db465639467e0ba1878b02c_JaffaCakes118
Size

164KB
MD5

5c0fc3302db465639467e0ba1878b02c
SHA1

6d5d47d392f307a1d1808e924b3f2ae109b87b64
SHA256

1644c2ade71d6f282398cd2a51d513fdec4f1c4c0c5c27d7248d3f62de83be13
SHA512

adcde83fa5e562e08ecf20b54436ea25c97101a218570129c6e52d0a6721bbf1b71a064e0c536519f07189d577948a8dc4fe434084cbb6eb51d617eef62b305d
SSDEEP

3072:KN1YFH1wkhU+2im57OQSnfyqBpctQ8X/6xQ+M5E4NsTC8n+/:itkhU+2FhIfyoat7X/SQDmT1+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c0fc3302db465639467e0ba1878b02c_JaffaCakes118

Files

5c0fc3302db465639467e0ba1878b02c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6b14c3cb8e6dd8e8cebd264d16728720

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharUpperA
GetTopWindow
GetKeyState
CharNextA
wsprintfA
wsprintfW
MessageBoxA
CharLowerA

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

GetModuleFileNameA
LoadLibraryA
GetThreadIOPendingFlag
GetLastError
CompareStringW
TransmitCommChar
CreateFileW
GetProcAddress
CompareStringA
SetStdHandle
FreeLibrary
EnumResourceNamesW
WideCharToMultiByte
CloseHandle
WriteFile
MultiByteToWideChar
CreateMutexA
GetTempPathW
FlushFileBuffers
ExitProcess
InterlockedDecrement
LoadLibraryW
InterlockedIncrement
IsBadReadPtr
SetEndOfFile
SetEnvironmentVariableA

msimg32

AlphaBlend
TransparentBlt

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ