bc535f30b6e83f0e19d34281a57b2403_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bc535f30b6e83f0e19d34281a57b2403_JaffaCakes118
Size

184KB
MD5

bc535f30b6e83f0e19d34281a57b2403
SHA1

8a1f8332b4f6ed3b0276a34956eabea8d5336ecf
SHA256

18413e200ad9c5b139a63fc7cfbdbd623f3828b548af364fcf5c7073db6c6263
SHA512

2e544354e841165db3ee10991efc9ad5012e9fe8c851dc8b83092fc33d1abe707285bdcbdc38094f272f4df8b10b260ef1a4ba85878c673e59b5f6d522ca2e09
SSDEEP

3072:kKEjq3zB5nll6OVWbUVAFOS9y9CNjKvjNg094CRsGhfYUG8C65e3kODbU79qgi9:XEWt5lJVib7zjSNnRsGqUtCFkOU7Igq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc535f30b6e83f0e19d34281a57b2403_JaffaCakes118

Files

bc535f30b6e83f0e19d34281a57b2403_JaffaCakes118
.exe windows:5 windows x86 arch:x86

068241376589a96ebe53ca13771ab1b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
CreateFileA
LCMapStringA
LoadLibraryA
CloseHandle
ExitProcess

user32

CreateWindowExA
SetWindowLongA
wsprintfA
CloseWindow
CharLowerBuffA

advapi32

RegOpenKeyA
RegCloseKey
RegEnumKeyA
RegQueryValueA
RegCreateKeyA
RegDeleteValueA
RegEnumValueA
RegSetValueA
RegDeleteKeyA

Sections

.text
Size: 167KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ