a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118 | Triage

Sharing

General

Target

a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118
Size

264KB
MD5

a35da464fd7d4c0495991c6f744c5eae
SHA1

f4d4cfd014ec6c355124f1e5bb7403b6687d98e8
SHA256

c5439fd5d68636c4f2ec073060bbda129ca3617d83e5548e2884b2e44f986a70
SHA512

2ad0fc42438278111a3ff790f264c037cb14a6fe01aae62d0d45f00d9dcf496b99bd394cc48e370b569dd825c73c6d089f0e12e0a7a2b83348742b0a7af29226
SSDEEP

6144:HxVOxPmUh+maCnJU8p0wc1E8ripaBOl+JmozsJlI/OQrSOJ:HxVOhhXrrgBK7ozKlGP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118

Files

a35da464fd7d4c0495991c6f744c5eae_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2aa9c11628ebe8594930d24477e44735

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
CloseHandle
LoadLibraryA
CreateFileA
GetCurrentProcess
ExitProcess

user32

CreateWindowExA
SetWindowLongA
CharLowerBuffA
CloseWindow
wsprintfA

advapi32

RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegEnumValueA
RegCreateKeyA
RegOpenKeyA
RegEnumKeyA
RegSetValueA
RegQueryValueA

Sections

.text
Size: 247KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ