7002978c5468bbbf89bcb556dcba2a23_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7002978c5468bbbf89bcb556dcba2a23_JaffaCakes118
Size

173KB
MD5

7002978c5468bbbf89bcb556dcba2a23
SHA1

126077bf434bdb248698d7a44156a1890498f8fd
SHA256

91019be3c71954fb692361e4cc22973408387647060d57e40797587870843757
SHA512

bc5c8e89c2bb60845e27ca569e28af3ba0d96bc1c3022f9e5baf9d68f206da4ec8a5c72eea5fa6d4f9c03fc8deeb1206693a3ffd7f306fd062ef4b8891daabfd
SSDEEP

3072:ovBOqy1JGz6iYP3AroX8QR0ifeRdz8xCxSdG66WkzqaTnsO5GBEwrqGDZ9PdlE:jqysY/AqCx80hzqInKBEa7D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7002978c5468bbbf89bcb556dcba2a23_JaffaCakes118

Files

7002978c5468bbbf89bcb556dcba2a23_JaffaCakes118
.exe windows:4 windows x86 arch:x86

201caba79566ca8994a9b2fc9153f857

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

AlphaBlend
TransparentBlt

user32

CharNextA
GetTopWindow
GetKeyState
CharLowerA

kernel32

GetThreadPriority
FreeLibrary
TransmitCommChar
LoadLibraryW
EnumResourceNamesW
ExitProcess
LoadLibraryA
InterlockedDecrement
GetProcAddress
InterlockedIncrement

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

Sections

.text
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ