a44d0f26283b4b4c3aac0f6571b784d4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a44d0f26283b4b4c3aac0f6571b784d4_JaffaCakes118
Size

46KB
MD5

a44d0f26283b4b4c3aac0f6571b784d4
SHA1

d0a97da2117aa1f895e70cfb83f0e135fbb13186
SHA256

f6b4423425a85dea09a45fd089a0426e7fe1c079d16bb03cb8c49fd6b45f71ac
SHA512

344ec7c3416224e0debc491dc33108451d1103d97705ad45610c54c344c3eb524c48ed3ee27c5aa6e19833f0aa04296827130458b869565ea6557c56b9886525
SSDEEP

768:NikPjbeftM6Q9mYo4JR3tFi9eHYaNg7g1LbYV6Vn197YXGaPGNyiI3yRNzr:fr8H4JttFDYa9tYVi1XiAl0gr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a44d0f26283b4b4c3aac0f6571b784d4_JaffaCakes118

Files

a44d0f26283b4b4c3aac0f6571b784d4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b58be843f990ebbbf4bc06e6b16aa029

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
AddAtomA
VirtualFree
GetModuleHandleA
GetProcAddress
FindAtomA
FreeResource
VirtualAlloc
FindResourceA
SizeofResource
LoadResource
LockResource

user32

UpdateWindow
wvsprintfA
UnloadKeyboardLayout
WaitMessage
WindowFromPoint
wsprintfA
UnpackDDElParam

advapi32

CryptReleaseContext
RegEnumKeyExA
CryptDestroyKey
RegFlushKey
CryptHashSessionKey
CryptImportKey
CryptExportKey
RegQueryValueExA
CryptSignHashA
RegEnumValueA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 862B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 131B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ