b89630fa829df250562d8c7913a666b1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b89630fa829df250562d8c7913a666b1_JaffaCakes118
Size

249KB
MD5

b89630fa829df250562d8c7913a666b1
SHA1

da44f411e2af49dcc57bdfc43616e053e011fb2e
SHA256

52580f11f69b7b1a1cc707a3af78637da2f6c5d643381e29076a2cb3c455f6b6
SHA512

468a022e46180e0b6da4d684030a1778b9a884ed5ef39785663d80173c1e8d3416ef5b45c5aff6b34976d36b62f360278ed1dda9bc53a6393276cf80fc3d241f
SSDEEP

6144:9GO4UNcIa5JrgfMGydK7OuKraFIpmZxjSS3t2ZwrFixh:9FpNcIa5JMk1SIpmzP3s0Fy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b89630fa829df250562d8c7913a666b1_JaffaCakes118

Files

b89630fa829df250562d8c7913a666b1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4dfca92388e5b83540f534ae4654b4be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
CreateFileA
ExitProcess
LoadLibraryA
GetCurrentProcess
LCMapStringA

user32

CharLowerBuffA
CloseWindow
wsprintfA
SetWindowLongA
CreateWindowExA

advapi32

RegDeleteKeyA
RegOpenKeyA
RegCreateKeyA
RegSetValueA
RegEnumKeyA
RegEnumValueA
RegCloseKey
RegDeleteValueA
RegQueryValueA

Sections

.text
Size: 180KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ