85fbabb2efaa7655d6a538a65b9ee218_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

85fbabb2efaa7655d6a538a65b9ee218_JaffaCakes118
Size

541KB
MD5

85fbabb2efaa7655d6a538a65b9ee218
SHA1

35731563657e30ddb18a7ba43b95fe39c38f8e4f
SHA256

6ca014a35b5b0836914d970b193c45ef3b0ef85d486a2c261bf9ea27625701ab
SHA512

9eb051271e19b75a5b471336b5e79f2e05b478d51aca54b18406e5e4c2247ecb8e27b7d92eba4a73916c9349ce9181431fda986cdd7b4c6722c424cc5a154945
SSDEEP

6144:bwxMpv+Bo/gSAhmJB2ZBTynaKAm1sQegkUE1o3CZTNrOM+IOJaW0I2vQplSZkOiy:bXv3lAwJB0+3AkyT4M+/2vvNVR++

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85fbabb2efaa7655d6a538a65b9ee218_JaffaCakes118

Files

85fbabb2efaa7655d6a538a65b9ee218_JaffaCakes118
.exe windows:5 windows x86 arch:x86

88882d35c74322dcdad6a3b424e31027

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
ExitProcess
LCMapStringA
LoadLibraryA
CreateFileA
CloseHandle

user32

CharLowerBuffA
SetWindowLongA
wsprintfA
CreateWindowExA
CloseWindow

advapi32

RegDeleteKeyA
RegEnumValueA
RegEnumKeyA
RegQueryValueA
RegSetValueA
RegCreateKeyA
RegCloseKey
RegOpenKeyA
RegDeleteValueA

Sections

.text
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ