5d803dbd673f892f2f2c4503c89be442_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5d803dbd673f892f2f2c4503c89be442_JaffaCakes118
Size

257KB
MD5

5d803dbd673f892f2f2c4503c89be442
SHA1

5d091d2b77be78ff23f3afacae9e39bec6b221b3
SHA256

e17a03a29d3fa7ca71dccc0f6528c080e50a7f5d68d79b4c4f087e2b7c3ff392
SHA512

4db62960c50a9d5adad430dddd8658829880135966ce5f36ffb7dcf2eef670035a1c6abf0a3777b7bc3ea6ed9c8b95968579f6d9557eb748cf78978f6f39d38c
SSDEEP

3072:3WuPF23Xu7YOdSEJHxvSZIkBr4uPcze6e/ko4acPRF4ztz0F8Nu0SvJD:mu8FOdBHm6i/X4aGj4ztzk8IhD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d803dbd673f892f2f2c4503c89be442_JaffaCakes118

Files

5d803dbd673f892f2f2c4503c89be442_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ce9ffaf192e2f9480cc1868249fd3b79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
ExitProcess
CreateFileA
CloseHandle
LCMapStringA
LoadLibraryA

user32

SetWindowLongA
CreateWindowExA
CloseWindow
CharLowerBuffA
wsprintfA

advapi32

RegSetValueA
RegOpenKeyA
RegCreateKeyA
RegEnumValueA
RegEnumKeyA
RegQueryValueA
RegDeleteValueA
RegDeleteKeyA
RegCloseKey

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ