71dbb0769437cc6372611bd8880af0c6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

71dbb0769437cc6372611bd8880af0c6_JaffaCakes118
Size

160KB
MD5

71dbb0769437cc6372611bd8880af0c6
SHA1

c73c9947d303d6eceba47061e41d4ad5b31ca507
SHA256

c0b2e9ca281ec5ca7b644b5b5dbf846c3df0849acf039dd441f8367472a0866c
SHA512

76cdc7b8d141d11c796f4982ddacd89c56eff0f4f4b6f762b1b6b6c5b7a9ab4609a4accf6dc121ad2bf8452a5a0bc2dc082b800b30505fb0dbe639a3f2851494
SSDEEP

3072:uRe9ZPBEDQnxI7U8Z6389yGZkC+y8anAR/oiUg:5ZKx7V4S8anANoip

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71dbb0769437cc6372611bd8880af0c6_JaffaCakes118

Files

71dbb0769437cc6372611bd8880af0c6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

712528d8f1239a2b69062d9850334395

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
CloseHandle
CreateFileA
GetCurrentProcess
ExitProcess
LCMapStringA

user32

CharLowerBuffA
wsprintfA
CreateWindowExA
SetWindowLongA
CloseWindow

advapi32

RegEnumValueA
RegDeleteValueA
RegCloseKey
RegSetValueA
RegQueryValueA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA

Sections

.text
Size: 143KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ