8d6165e22677376f482a1cc286eef21f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d6165e22677376f482a1cc286eef21f_JaffaCakes118
Size

180KB
MD5

8d6165e22677376f482a1cc286eef21f
SHA1

823dd69ec63b45c94694b4683a81f8874d325b87
SHA256

19c2630a03a1139b9d778b1a8c84acd182edec1b847d0786309dd1cc1833cfe5
SHA512

873e4902f9fa15cd2d0213cf50a30782f7fd242a155c96e5f8c39bb3184817b9cf014e62feaba8c67f662925c0a14a3231c79be480298d8f654741b94338ae2b
SSDEEP

3072:jgHrRLZp79QRR3laW6tPDi6VSBTeosGJeC/QzaQwtt2Y6W0J2+EaqsTjxnpnJyR:kRZp79QL3lv07i6CJFT5Fj857JV8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d6165e22677376f482a1cc286eef21f_JaffaCakes118

Files

8d6165e22677376f482a1cc286eef21f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a8408db79a94f68d05a712fba5547317

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
CreateFileA
LoadLibraryA
ExitProcess
CloseHandle
GetCurrentProcess

user32

CreateWindowExA
SetWindowLongA
wsprintfA
CloseWindow
CharLowerBuffA

advapi32

RegOpenKeyA
RegEnumKeyA
RegCreateKeyA
RegDeleteValueA
RegQueryValueA
RegDeleteKeyA
RegCloseKey
RegSetValueA
RegEnumValueA

Sections

.text
Size: 161KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ