6756b4116445135dbac6946eea8cd649_JaffaCakes118 | Triage

Sharing

General

Target

6756b4116445135dbac6946eea8cd649_JaffaCakes118
Size

168KB
MD5

6756b4116445135dbac6946eea8cd649
SHA1

81cbb2efe09d2c87c5b3b0a6ade757b9e55e0f9c
SHA256

924a9801b23e11d53b940c43764a84417892a468b86a0299f1bed95ce000ac6a
SHA512

f23b8148c75dc2f50828394fa5b0ef871ebd88f0f44571ca24764e293732978e86b5d412bb354ca25f9ff3f41fc87cd7e625324c381c419ef34994e304abff8b
SSDEEP

3072:+cKEZtgwhdpyGlMExvgnBbs0l1uhnFp6n1H/Eam9h4JLP5C:+cjtgwhnbqnps+1uhnKH/E/Wrk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6756b4116445135dbac6946eea8cd649_JaffaCakes118

Files

6756b4116445135dbac6946eea8cd649_JaffaCakes118
.exe windows:4 windows x86 arch:x86

93068b775f44dd27226eddfdbc9c0279

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
CloseHandle
CreateFileA
LCMapStringA
LoadLibraryA
ExitProcess

user32

wsprintfA
CreateWindowExA
CloseWindow
CharLowerBuffA
SetWindowLongA

advapi32

RegDeleteKeyA
RegQueryValueA
RegCloseKey
RegCreateKeyA
RegOpenKeyA
RegSetValueA
RegEnumValueA
RegEnumKeyA
RegDeleteValueA

Sections

.text
Size: 148KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ