a1900943dc30b3f41b5a94cc20b72f40_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a1900943dc30b3f41b5a94cc20b72f40_JaffaCakes118
Size

184KB
MD5

a1900943dc30b3f41b5a94cc20b72f40
SHA1

dfd1fa7d6107b30169bab7a5db587ca64ad4f54d
SHA256

f83189fe1b3f0bda5df4eea0a2cc901d0fad49b3bec1ac9cfcb36a3b18507001
SHA512

5e0c8e4b8eb1bbdee94db659593c513bdf0c07313b20814deb798b3e32eb6c3c7bc5e7f5559ffc06cb0d4ef33ad8e287c49fdc2ac860a4a77c07d242a4d98dc0
SSDEEP

3072:A7mAnLZYBEMyPbaXwp/0xcuAnKafpYDolwazvfmuoktysZpcn8xHOc/30L3QYLDJ:jvBdyj4O/JRnxpYDQwgvfmuoUlTTOcPO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1900943dc30b3f41b5a94cc20b72f40_JaffaCakes118

Files

a1900943dc30b3f41b5a94cc20b72f40_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8ea47555a2430a970509c840caaf85ca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
GetCurrentProcess
ExitProcess
LoadLibraryA
CreateFileA
LCMapStringA

user32

wsprintfA
CloseWindow
CharLowerBuffA
SetWindowLongA
CreateWindowExA

advapi32

RegSetValueA
RegCreateKeyA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegQueryValueA

Sections

.text
Size: 165KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ