adbe5035726a8603d7fc0bf56e863e5a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

adbe5035726a8603d7fc0bf56e863e5a_JaffaCakes118
Size

171KB
MD5

adbe5035726a8603d7fc0bf56e863e5a
SHA1

26bd12e985089004322a1c2bd7efbf54c5ae8025
SHA256

45cd2a153d5227efd85dbf5812fcaeab0cf8e0f3f6bdce49734c11a127d9fb0f
SHA512

ba3764a0274e0c2ceb82a748f1d91ccb921ae8678c1b28435ad615d4dc7565dfab1f1cdec0e88a52ae3e6162a393db999abd71b98d82d4190166cd6ee902690d
SSDEEP

3072:rvu8wS36uDtMUBmSkEHAszYJFokTR+jMq6MF71979pewADd/:a8wo3BpjHAHjdnLMB/z4l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adbe5035726a8603d7fc0bf56e863e5a_JaffaCakes118

Files

adbe5035726a8603d7fc0bf56e863e5a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5c89e66982bdb09e61dee7f9f4fa856c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

AlphaBlend
TransparentBlt

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

user32

GetTopWindow
CharNextA
GetKeyState
CharLowerA

kernel32

GetThreadPriority
InterlockedDecrement
TransmitCommChar
FreeLibrary
EnumResourceNamesW
ExitProcess
LoadLibraryW
GetProcAddress
LoadLibraryA
InterlockedIncrement

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ