6a8e17b3b490cfcdcf329ccf33719968_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6a8e17b3b490cfcdcf329ccf33719968_JaffaCakes118
Size

161KB
MD5

6a8e17b3b490cfcdcf329ccf33719968
SHA1

cd1d24c795d5b04b153819b556d67202b3289435
SHA256

c6fc1d2cefd197026f6c701c8d56ed1786029d745d7bbf258c83f61e2d33ded5
SHA512

222fdaee58a486049992f96b1597a323d7fc038e292426173257c0f58eedfabfb4d509086c3639d70488a65d0d9104cc5a5c84669929963d14f603c779250aa0
SSDEEP

3072:ZiAbLLEv8ly+N7GhoEOwBYASrDrAqQQQQQQQQofHmnXGWKsUknh1Qv0:rB0+xUROwBYASUqQQQQQQQQoCWBknh1r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a8e17b3b490cfcdcf329ccf33719968_JaffaCakes118

Files

6a8e17b3b490cfcdcf329ccf33719968_JaffaCakes118
.exe windows:4 windows x86 arch:x86

326c9654f0ca780ca5545a1a0d3db0d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
ExitProcess
LoadLibraryA
LCMapStringA
GetCurrentProcess
CreateFileA

user32

CharLowerBuffA
wsprintfA
CreateWindowExA
SetWindowLongA
CloseWindow

advapi32

RegCreateKeyA
RegEnumKeyA
RegDeleteValueA
RegSetValueA
RegEnumValueA
RegCloseKey
RegOpenKeyA
RegDeleteKeyA
RegQueryValueA

Sections

.text
Size: 142KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ