78c7e0c41ae53401598ff928ab516d3f_JaffaCakes118 | Triage

Sharing

General

Target

78c7e0c41ae53401598ff928ab516d3f_JaffaCakes118
Size

46KB
MD5

78c7e0c41ae53401598ff928ab516d3f
SHA1

c2add1b37307c1f5b9e4f40d2446a0371fc0907c
SHA256

1c65c4b6064f62bf6497b66aa06db128d2ca64450da0fbc4fc29416a9974c5eb
SHA512

b3843fb8e8788ecaabb28e9c35ca017a8594e44ea6d617f43a7f1d7cbb0ba29a65e6fbc49b1ad353ed15f4fab36a357ed2b5fe92b54bc813a20e0a98215c1cee
SSDEEP

768:NqdyHel9qDTcFE3TezyH59KgrZmhQB0nBR27nsp7iEos2zFaYdK8oQbDr3Uo:Nf+kQuimH3LdQs2BkrK7JkFaYdK9Q/L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78c7e0c41ae53401598ff928ab516d3f_JaffaCakes118

Files

78c7e0c41ae53401598ff928ab516d3f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

02ee230d1379ce10726fafeb89281967

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
VirtualFree
FreeResource
AddAtomA
VirtualAlloc
GetProcAddress
LockResource
GetModuleHandleA
FindAtomA
FindResourceA
SizeofResource
LoadResource

user32

WaitForInputIdle
UnregisterClassA
WinHelpA
WindowFromPoint
UnionRect
wvsprintfA
ValidateRect
UnpackDDElParam
WindowFromDC
WaitMessage
wsprintfA

advapi32

CryptExportKey
RegConnectRegistryA
RegQueryValueA
RegQueryValueExA
CryptGenRandom
RegQueryInfoKeyA
CryptVerifySignatureA
RegDeleteKeyA
CryptDestroyHash
CryptGenKey
CryptGetHashParam
GetUserNameA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1010B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ