a7883d0d117459a6f66e8fabd0ab5a90_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a7883d0d117459a6f66e8fabd0ab5a90_JaffaCakes118
Size

228KB
MD5

a7883d0d117459a6f66e8fabd0ab5a90
SHA1

023725fced6c4b208de142a984cc39c4ab3c2313
SHA256

8760f7d74d05ea7510084b1e0f7134a61dd701d3a79e59a2046d92f2f1abe3bd
SHA512

2dd11587dfd1bee71acc103db81b1f5d96de128c76063f22cc8826af56f155b88d9c208ef04bc98318153ed542d61aed9e2b4b7e29566ef9f3bca656373c423b
SSDEEP

3072:lazUKt+bQ3/ryK159D591Y2smS2tyaEVcsQYCE8MEwvkBnvJCMkh/UYItepRMyI6:bKkMuK1Ld9AGtyaLdMFsBvUMMKepKlpW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7883d0d117459a6f66e8fabd0ab5a90_JaffaCakes118

Files

a7883d0d117459a6f66e8fabd0ab5a90_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b8134148dad993698f1e428be08306a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
CloseHandle
LoadLibraryA
GetCurrentProcess
CreateFileA
ExitProcess

user32

CreateWindowExA
SetWindowLongA
CloseWindow
CharLowerBuffA
wsprintfA

advapi32

RegQueryValueA
RegCloseKey
RegEnumValueA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA
RegSetValueA
RegEnumKeyA
RegCreateKeyA

Sections

.text
Size: 211KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ