b70647b72a56f3c363716792a26df67c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b70647b72a56f3c363716792a26df67c_JaffaCakes118
Size

173KB
MD5

b70647b72a56f3c363716792a26df67c
SHA1

bb17b23ffc3b7575d862bb012da0b520699d9304
SHA256

409d2ff35f4154d9f1be37df5441a05f397a031b27d74f932277713cac11ddd5
SHA512

43e02b45898d72ccd5bc08993fc8cd481a9e67e27f640f9c955157494e73f1bced79f8fe6e3c0225b99ebfb33c68f605ae84b1659b5c76435c337c3ad3a87621
SSDEEP

3072:0v4r49uk1+QqwsHqVM9H6uPWV5gbbPVFYAu2an/4GG4y0u5LE3EKG5WceGKqhjrQ:NUuyqPHqVMkapbbP8Zn/DZUlE0KG5zeJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b70647b72a56f3c363716792a26df67c_JaffaCakes118

Files

b70647b72a56f3c363716792a26df67c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6cde9548e972fec5144f6c4cee8021d5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharNextA
GetClassLongA
GetKeyState
CharLowerA

msimg32

AlphaBlend
TransparentBlt

kernel32

GetThreadPriority
FreeLibrary
TransmitCommChar
LoadLibraryA
EnumResourceNamesW
ExitProcess
InterlockedDecrement
GetProcAddress
LoadLibraryW
InterlockedIncrement

advapi32

RegCreateKeyExA
RegCloseKey
RegQueryValueExA

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ