b322a1759d1a10b36f9c4ded189be502_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b322a1759d1a10b36f9c4ded189be502_JaffaCakes118
Size

13KB
MD5

b322a1759d1a10b36f9c4ded189be502
SHA1

33604abe8475fb8130e5c7c0dd3c39839c88c538
SHA256

52fa74b70ae0f1c743490634ce5a1b6032e14f50d64542214701c82167b92055
SHA512

d151b7c19397299bbba2f4952aded8d41e96a2e368ac2128bc6c977aaf0a961b42d20af0c5eff5811ebab4bc38e0f75bbea355c2a4f5b91b428348ffbddeffac
SSDEEP

192:won8FS49WcepIkkw8gxtC3oPIaGaK9ESaPm0/h2Ia/:n8FR9JgIMPnTKGVZ2Iy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b322a1759d1a10b36f9c4ded189be502_JaffaCakes118

Files

b322a1759d1a10b36f9c4ded189be502_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2df2514cfc2a7bc6803f600db04700a3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
CloseHandle
GetCurrentProcessId
GetModuleHandleA
lstrcpyA
GetProcAddress
lstrcatA
ResumeThread
WideCharToMultiByte
ExitProcess
Process32First
LoadLibraryA
CreateToolhelp32Snapshot
CompareStringA
CreateEventA
RtlUnwind

user32

GetGuiResources
IsWindow

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE