bc59ce16627f2746f0784d58496f3282_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bc59ce16627f2746f0784d58496f3282_JaffaCakes118
Size

160KB
MD5

bc59ce16627f2746f0784d58496f3282
SHA1

3fef13354be30b8d3a0b7e8b825a6c113a15db90
SHA256

bc225518c2a3713759ca712867bf8525260f3657713b627c354177339ababefc
SHA512

578ad4b3f6f78814f56e1af9b691a517ea68b295931bad646a278a34402d3136f927dfa9d3a50d453b293cafe7dff75010a61ff0f06cddc7f050f1d804d16dba
SSDEEP

3072:GRPEkxuM4ss1nlV9iyrvJSXatPQBhFRtk5uWlXy4R3:2utpll/drvJDYB/RtsS4J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc59ce16627f2746f0784d58496f3282_JaffaCakes118

Files

bc59ce16627f2746f0784d58496f3282_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8b95901016aefaa26c67a232eb57bce6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
CreateFileA
CloseHandle
LoadLibraryA
LCMapStringA
ExitProcess

user32

SetWindowLongA
CreateWindowExA
CloseWindow
CharLowerBuffA
wsprintfA

advapi32

RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
RegOpenKeyA
RegSetValueA
RegEnumValueA
RegQueryValueA
RegEnumKeyA

Sections

.text
Size: 142KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ