699a9961eaba87d8eea220ff113d3769_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

699a9961eaba87d8eea220ff113d3769_JaffaCakes118
Size

216KB
MD5

699a9961eaba87d8eea220ff113d3769
SHA1

2e49508bcb22c473ee40a0415de3cc514393ab21
SHA256

1e11921ecc0d092c2d4ca8cec5f746e40f44591c20cc510d91e1a71a83cf27ae
SHA512

b1fed9c03072e991802c7bc29c82c3e25d41b1d10b631dcf8077ba0e14967f0db3c8c7196199145b77d47cba9c47b6bc91f27afea274dda03b823be5daf3250d
SSDEEP

3072:Oj3gZ/oXBcT7JkjkstZ1uy/Z17mko9C0vgqodzuv+Uma/vtErVzUIUK+y:OLgexcx8J5uybal9CQYdzYP/v6rVzUDy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
699a9961eaba87d8eea220ff113d3769_JaffaCakes118

Files

699a9961eaba87d8eea220ff113d3769_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d0e586c0c699626d43422c1d78a78bef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
GetCurrentProcess
ExitProcess
LCMapStringA
CloseHandle
CreateFileA

user32

wsprintfA
CloseWindow
SetWindowLongA
CharLowerBuffA
CreateWindowExA

advapi32

RegDeleteKeyA
RegCreateKeyA
RegSetValueA
RegQueryValueA
RegEnumValueA
RegEnumKeyA
RegCloseKey
RegDeleteValueA
RegOpenKeyA

Sections

.text
Size: 4KB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ