af795d3b3f763d0b0f0fb7139984c7b9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af795d3b3f763d0b0f0fb7139984c7b9_JaffaCakes118
Size

185KB
MD5

af795d3b3f763d0b0f0fb7139984c7b9
SHA1

7e5ddd8e4dd126b2fd8905518ab5f320e6eae410
SHA256

8aff4b36da523948dedf1fe2c1d4d501fb2f8c26407e572537933c57cd28919a
SHA512

5b0af4a0a9f4c93f60465f191d4a96395d42c7517549b79f5b3b32edac0622ce2b0eba00c4e229249e8d3a205ea8ad0709c340ef70ee5405eff0653aac9d845d
SSDEEP

3072:z74Id1FLERv4rrxjBovoN3akJHFXsxdbj7gCQo8MIAOarktHav9TzAqIEIM2SaIJ:v9XU4rrxjBBHm703fAO2cATtIEqym1i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af795d3b3f763d0b0f0fb7139984c7b9_JaffaCakes118

Files

af795d3b3f763d0b0f0fb7139984c7b9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f8ec20a7f46ac3188b08bf16ea42fea3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
CloseHandle
LoadLibraryA
GetCurrentProcess
CreateFileA
LCMapStringA

user32

CharLowerBuffA
wsprintfA
CreateWindowExA
SetWindowLongA
CloseWindow

advapi32

RegCreateKeyA
RegEnumKeyA
RegQueryValueA
RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegEnumValueA
RegOpenKeyA
RegSetValueA

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ