6a831d3411978af706d260e802db2686_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6a831d3411978af706d260e802db2686_JaffaCakes118
Size

408KB
MD5

6a831d3411978af706d260e802db2686
SHA1

9fc0a14adb8d4b242d4adc76eef663a028b1db01
SHA256

f6f0b1cbc1a130ed4fdfe15bf34fcf071e10441436b8707bea172daa9a3e7d40
SHA512

400a716935dd54c6e7fc261cb661c97e2ec7b5915e36cacd902909f9c54907b6f4d28f2b51722892ca4d5c9215c56886e51bcd6dcc2e805efd55c914817e3e01
SSDEEP

6144:2ZlnEv2AoKKk+RzTERnwYv7HK67QRtOnGPUccRXWdcnHNnv/3+C7Y:SC2T1zKnwYz571nGccceMtv/3k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a831d3411978af706d260e802db2686_JaffaCakes118

Files

6a831d3411978af706d260e802db2686_JaffaCakes118
.exe windows:4 windows x86 arch:x86

928abb7fce25ae0d55a9503efb7c0bed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
CreateFileA
ExitProcess
LCMapStringA
GetCurrentProcess
LoadLibraryA

user32

CloseWindow
CharLowerBuffA
CreateWindowExA
wsprintfA
SetWindowLongA

advapi32

RegOpenKeyA
RegCreateKeyA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey
RegQueryValueA
RegDeleteValueA
RegEnumValueA
RegSetValueA

Sections

Size: - Virtual size:

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ultra
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ