bebd0c27c9898d24db894b86875d3f18_JaffaCakes118 | Triage

Sharing

General

Target

bebd0c27c9898d24db894b86875d3f18_JaffaCakes118
Size

226KB
MD5

bebd0c27c9898d24db894b86875d3f18
SHA1

1d07071265b6486f5090244dc1a0b917ceb700f5
SHA256

52a85ca6e1224d3d916906e590807eda530b198412ba8f771d0cfcff7a542571
SHA512

0f1d99f1c08d20e41268fe23c586c8edcc69b2d425c87c00977998de3a277653a7e5b0b9ce1a5de24678675923ef2c1ff73fb481c5c14ddff17ddad07339f44d
SSDEEP

6144:ABGBarbFuRR6BmmYh+jEBTRRdpIYt4YwfptB76:ABvrbs2mhKElIYt4YwxjG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bebd0c27c9898d24db894b86875d3f18_JaffaCakes118

Files

bebd0c27c9898d24db894b86875d3f18_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0fa8ec6111d04fb389c32cb5011124a3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
LCMapStringA
ExitProcess
GetCurrentProcess
CloseHandle
CreateFileA

user32

CloseWindow
CharLowerBuffA
CreateWindowExA
wsprintfA
SetWindowLongA

advapi32

RegCloseKey
RegDeleteKeyA
RegEnumValueA
RegSetValueA
RegCreateKeyA
RegOpenKeyA
RegDeleteValueA
RegEnumKeyA
RegQueryValueA

Sections

.text
Size: 156KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ