af8091af1b3995157abed5b2dbe82311_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af8091af1b3995157abed5b2dbe82311_JaffaCakes118
Size

437KB
MD5

af8091af1b3995157abed5b2dbe82311
SHA1

ee8550b12a256eb70c3b085e4e936a424ec84296
SHA256

8ed73666273b716e2092dbae33071f325164ee745d42056dd0f6d80217f2d0a1
SHA512

761359ac9af7a258b75f677d50e6dae8bcc3c90cddfd72302db046c524cc0e873a4bfb8e71dfa1295c88056d7e2ceb2c4347bfd4146e9c72d7a8090bbe244ccf
SSDEEP

12288:dqxKMyb+xVz7W/CFYRSszsFuXgDWGEJXtbS:dqxbfFszsFuXNGEBtG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af8091af1b3995157abed5b2dbe82311_JaffaCakes118

Files

af8091af1b3995157abed5b2dbe82311_JaffaCakes118
.exe windows:4 windows x86 arch:x86

af2ee289e1d480f15fe227b349d9e487

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
LCMapStringA
GetCurrentProcess
CreateFileA
CloseHandle
LoadLibraryA

user32

wsprintfA
CloseWindow
SetWindowLongA
CharLowerBuffA
CreateWindowExA

advapi32

RegCloseKey
RegDeleteKeyA
RegEnumKeyA
RegSetValueA
RegOpenKeyA
RegEnumValueA
RegCreateKeyA
RegDeleteValueA
RegQueryValueA

Sections

.text
Size: 4KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ