95232d577df68b12891e1819288faab6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95232d577df68b12891e1819288faab6_JaffaCakes118
Size

368KB
MD5

95232d577df68b12891e1819288faab6
SHA1

312bb146efd33c3b340087b2e75c316ae69ef0fa
SHA256

239c17a62c00a7ab2b47e6333371dd416da519313b6856f3e601011c958786a6
SHA512

5189d595160b28146833c76661447627b731b43b7f78cccfb2ccbd99554617b242e4d33c0b4b0f9d904e5650bdbb0f676f0a9a189d4a4009d8135f53e92c68ab
SSDEEP

6144:f67WABqzYEQXPqi2EYLFNwXoCTYG4MZg3EizguqNp6Y9UYTwPgs6j4H:f65XPb2/Mo9G3izRqNp/PEd60H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95232d577df68b12891e1819288faab6_JaffaCakes118

Files

95232d577df68b12891e1819288faab6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6cf54e99ea60b01059488acbc9a35335

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
GetCurrentProcess
ExitProcess
LoadLibraryA
CreateFileA
LCMapStringA

user32

SetWindowLongA
CloseWindow
CreateWindowExA
wsprintfA
CharLowerBuffA

advapi32

RegDeleteValueA
RegOpenKeyA
RegSetValueA
RegEnumKeyA
RegDeleteKeyA
RegEnumValueA
RegCreateKeyA
RegCloseKey
RegQueryValueA

Sections

.text
Size: 125KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 228KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ