c0bce7a04e5b4f84c81d1f2f5eb75dd3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c0bce7a04e5b4f84c81d1f2f5eb75dd3_JaffaCakes118
Size

192KB
MD5

c0bce7a04e5b4f84c81d1f2f5eb75dd3
SHA1

9c14ced401d1c5c72be4f483f217c6b3715b9895
SHA256

8f68c23b8537431d590f90f634d94f76dafd649b9a76c0788a2bfc6f82576534
SHA512

e3aad3b03a63b51086b0ba0ee0901b902fcde045771c5e9a4d0b7245270624ad345682e7b7af8c5294e1ff5efddda9c08a6a9cca1f3c3af10f6c5a285d9bee0a
SSDEEP

6144:DFOyonVu+DonOnl9OJnbAxXC7YKh8Zt33O:hFoQhCkJbAMUKi/33O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0bce7a04e5b4f84c81d1f2f5eb75dd3_JaffaCakes118

Files

c0bce7a04e5b4f84c81d1f2f5eb75dd3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6a70e735d7b47ef67bee0d419f7ecb04

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
ExitProcess
LCMapStringA
CreateFileA
LoadLibraryA
CloseHandle

user32

CharLowerBuffA
SetWindowLongA
CreateWindowExA
CloseWindow
wsprintfA

advapi32

RegDeleteValueA
RegEnumValueA
RegEnumKeyA
RegQueryValueA
RegCreateKeyA
RegDeleteKeyA
RegCloseKey
RegSetValueA
RegOpenKeyA

Sections

.text
Size: 145KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ