9540ea85264a948e9cb8214a563366fd_JaffaCakes118 | Triage

Sharing

General

Target

9540ea85264a948e9cb8214a563366fd_JaffaCakes118
Size

625KB
MD5

9540ea85264a948e9cb8214a563366fd
SHA1

0438d9221413f685016911b7e38252bfe3695cad
SHA256

464412eef04282e0bea6ead9d7229e461f93e8137e573a2c5a2f8451acafc363
SHA512

19ab176c35f2bea229f83749ce4a0b45a16aa78ad6a9072a1c9e0cac0ac9854db64666563a264b59807db4f77447e44fdc7efde01633318fe9a2c2d66582fb89
SSDEEP

12288:CepcXpA1BIxoHnjba7Xt3CFKM4ROKDKRC2p6Pg76fv6n4uZ7QM4JHNYX6rdtGAwm:CKcXpAH1Xa7XFC4M4RXDSOgQA4uZ7CJH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9540ea85264a948e9cb8214a563366fd_JaffaCakes118

Files

9540ea85264a948e9cb8214a563366fd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4b0c65ddc847e76b92035848cf2b3945

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
ExitProcess
LoadLibraryA
LCMapStringA
GetCurrentProcess
CreateFileA

user32

wsprintfA
SetWindowLongA
CreateWindowExA
CharLowerBuffA
CloseWindow

advapi32

RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegSetValueA
RegDeleteValueA
RegCreateKeyA
RegDeleteKeyA
RegEnumValueA
RegQueryValueA

Sections

.text
Size: 556KB - Virtual size: 560KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ