603699195d41c6294d457e66d1602612_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

603699195d41c6294d457e66d1602612_JaffaCakes118
Size

164KB
MD5

603699195d41c6294d457e66d1602612
SHA1

763c19abcf43a1974aa6ca5dfd8c550989195585
SHA256

8397ca3961485e5fb82ea89ad49abf069772e13820fc359b1e542bddff41de36
SHA512

f684250d414a73ce336a6fdd3bf5f4d85a63d08f52531d406b45058c650897286d52fc235f6efaa69638775134c85165c537661ea3dfaa428b55031ca86b762f
SSDEEP

3072:KN1YFH1wkhU+2im57OQSnfyqBpctQ8X/6xQ+M5E4NsTC8n+/:itkhU+2FhIfyoat7X/SQDmT1+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
603699195d41c6294d457e66d1602612_JaffaCakes118

Files

603699195d41c6294d457e66d1602612_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6b14c3cb8e6dd8e8cebd264d16728720

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharUpperA
GetTopWindow
GetKeyState
CharNextA
wsprintfA
wsprintfW
MessageBoxA
CharLowerA

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

GetModuleFileNameA
LoadLibraryA
GetThreadIOPendingFlag
GetLastError
CompareStringW
TransmitCommChar
CreateFileW
GetProcAddress
CompareStringA
SetStdHandle
FreeLibrary
EnumResourceNamesW
WideCharToMultiByte
CloseHandle
WriteFile
MultiByteToWideChar
CreateMutexA
GetTempPathW
FlushFileBuffers
ExitProcess
InterlockedDecrement
LoadLibraryW
InterlockedIncrement
IsBadReadPtr
SetEndOfFile
SetEnvironmentVariableA

msimg32

AlphaBlend
TransparentBlt

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ