b4601453a29a96c6a3f320d9ee570628_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b4601453a29a96c6a3f320d9ee570628_JaffaCakes118
Size

220KB
MD5

b4601453a29a96c6a3f320d9ee570628
SHA1

6c89173c8129ef8ed5eb31c4bc379ac6047cd0c5
SHA256

664ca581b031907bd00907db0e83521f9257be061bfb0f7c00bb39aea2abbb70
SHA512

a2429bc9e806bf9cfaf3efdcb05a408895fba6ff627afa43ec3c924ddd45a0629cc295b44f27f043afb99d16cd7a9a941e59959cd3b11b77475712c6b20c2069
SSDEEP

6144:iuci/dJbe+Ez6lmUfc8zi4BJ3qaiZakn4i7KM5o:oijVsUtz4V4u4IB5o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4601453a29a96c6a3f320d9ee570628_JaffaCakes118

Files

b4601453a29a96c6a3f320d9ee570628_JaffaCakes118
.exe windows:4 windows x86 arch:x86

17fec388484727d1ba9e637a82494809

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
LoadLibraryA
CreateFileA
ExitProcess
CloseHandle
GetCurrentProcess

user32

CharLowerBuffA
SetWindowLongA
wsprintfA
CreateWindowExA
CloseWindow

advapi32

RegDeleteKeyA
RegCloseKey
RegDeleteValueA
RegQueryValueA
RegSetValueA
RegEnumKeyA
RegEnumValueA
RegOpenKeyA
RegCreateKeyA

Sections

.text
Size: 203KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ