6387b3232215e6ab61548553b82286d7_JaffaCakes118 | Triage

Sharing

General

Target

6387b3232215e6ab61548553b82286d7_JaffaCakes118
Size

188KB
MD5

6387b3232215e6ab61548553b82286d7
SHA1

8d6c0d82eb6bd331ee5f17f3ee582ab5c7f1bf16
SHA256

0ee5c13b53c2cf5b1f7fcd481e993b0f9a0370c120f300fcf3dfdf70a23f4a31
SHA512

209c92fb1ae727f0b61a9aaa6d054594d5a56306e8157850323b2243c121d29f2f4f80eb0dae202e535298cbab5648cb8a15e067761c40ed65db6a745a4880f6
SSDEEP

3072:mP4gQ2DznxT6pR4QZJF2taf8QT41JXDRW6C3UXY+0sPdO7fwG3nGLBMo7EI:3gQ2Dznx6pRhZ6+41523UX3rd8fwGXGt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6387b3232215e6ab61548553b82286d7_JaffaCakes118

Files

6387b3232215e6ab61548553b82286d7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

73802d2e8b9157c4ee959b4b33b2b4fb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
CreateFileA
GetCurrentProcess
CloseHandle
LoadLibraryA
LCMapStringA

user32

CreateWindowExA
CharLowerBuffA
SetWindowLongA
wsprintfA
CloseWindow

advapi32

RegOpenKeyA
RegCreateKeyA
RegSetValueA
RegQueryValueA
RegDeleteKeyA
RegEnumKeyA
RegEnumValueA
RegCloseKey
RegDeleteValueA

Sections

.text
Size: 168KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ