a97b02cc72bfd6faf86639730fb93dcb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a97b02cc72bfd6faf86639730fb93dcb_JaffaCakes118
Size

44KB
MD5

a97b02cc72bfd6faf86639730fb93dcb
SHA1

4291ec8790b124e56718d726cea1dcfc1dc25ac0
SHA256

9b1e8e4f45c5de2a1962fbea61cdf53ee7d98f26b4a2bfd3ef63134dee5bace2
SHA512

3cb345c8d544d4ef6478277e02cf059cafe2a6fcb34123765ed5a3f342ded6d96d8dcd18c1fe174c74b1444067ab9ded54bf210f7044c54b3786c906dd6d0736
SSDEEP

768:WVyPNTpfzFYJl50b8eFFj6igLBji1O53HVJwmYq7q8l7knxxXlMn2hUHlPkWS:51Tpf0Epy/HVymD7xl7kjlMZJVS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a97b02cc72bfd6faf86639730fb93dcb_JaffaCakes118

Files

a97b02cc72bfd6faf86639730fb93dcb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2c76ab25cdc26485f6541040efddec14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

audiodev

DllGetClassObject

msvcrt

memmove

ntdll

NtAllocateVirtualMemory
NtClose
NtCreateFile
RtlInitUnicodeString
LdrUnloadDll

advapi32

RegisterEventSourceA
DeregisterEventSource
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
ReportEventA

kernel32

lstrlenW

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 693B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ