b0646737d6505431d6ab1dab8c895d74_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b0646737d6505431d6ab1dab8c895d74_JaffaCakes118
Size

186KB
MD5

b0646737d6505431d6ab1dab8c895d74
SHA1

b0a2a72efe04b86fbcbfbbe7cc749a2ab4e979b0
SHA256

10264753ee4b655cdd257535c7135ee704b4392680598a01f0dbf8a790a90e94
SHA512

2896fea5270eec165ab1849b06604dd9db1f9f638b4dc90c4a5f7fe4cf775d637767f0ee3d6ea0c5244b234f5944a3a53610d75e44ecf0ad97cd6c74e3ec12a1
SSDEEP

3072:/MxJJ+yxptuHos5ZYDXI63PGArSG3/Q2bBeOAZWFTj+wqbxhSgO9rFLJ1V:4Dp0Hos5k3PGArSG3nbgO51XqKgO9rxN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0646737d6505431d6ab1dab8c895d74_JaffaCakes118

Files

b0646737d6505431d6ab1dab8c895d74_JaffaCakes118
.exe windows:4 windows x86 arch:x86

706166ce89ec1c23dbb000d963b55d29

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
ExitProcess
LCMapStringA
LoadLibraryA
CreateFileA
CloseHandle

user32

CharLowerBuffA
SetWindowLongA
CreateWindowExA
CloseWindow
wsprintfA

advapi32

RegSetValueA
RegCloseKey
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
RegCreateKeyA
RegQueryValueA
RegOpenKeyA

Sections

.text
Size: 167KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ