6a447b680555438af26c456fa6d32a75_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6a447b680555438af26c456fa6d32a75_JaffaCakes118
Size

288KB
MD5

6a447b680555438af26c456fa6d32a75
SHA1

376685fa9316990095ecb6dd852301e9208babd4
SHA256

1a92f6c854e5ed2a15429b552ffcfb33d53a3a69489ae64ee84fc24e4eab94bb
SHA512

296b217dd8a75930bdb36771cbf2feec7cc1bf0b603923d3373b3bf4feec4b77ea05246079a3732ad22bdda9e128d043cf1dd3cf4170fbb124229f43654bbc0e
SSDEEP

6144:z438g+PGqnXWcYOg4wGIgu4SY1DVfpjMAeHnp1TY6LoRr7lSSDcEFJv:MgXc4wcAwK1TY6c5xSS3v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a447b680555438af26c456fa6d32a75_JaffaCakes118

Files

6a447b680555438af26c456fa6d32a75_JaffaCakes118
.exe windows:6 windows x86 arch:x86

60528b088e9d61f5631306cc4f8128dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
LoadLibraryA
CreateFileA
LCMapStringA
GetCurrentProcess
CloseHandle

user32

CreateWindowExA
wsprintfA
CloseWindow
SetWindowLongA
CharLowerBuffA

advapi32

RegCreateKeyA
RegEnumKeyA
RegCloseKey
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
RegQueryValueA
RegSetValueA

Sections

.text
Size: 263KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ