c25e10a3e25c6b3b96789a52d6fe3048_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c25e10a3e25c6b3b96789a52d6fe3048_JaffaCakes118
Size

432KB
MD5

c25e10a3e25c6b3b96789a52d6fe3048
SHA1

6855fcf6b9b68491ce10ae272d31a3a37683b76e
SHA256

2d0a66605b406ed61bd6cf5478f79001308d70bcfc0ee403ea74da3173cfa785
SHA512

251410a202849bbc911670991508b6f4ed9f1e4f87cba882403e4a0b8aa342144341fe3c0380b4550b3e25859a0702c10bcf7480683717d6c247b74de3856224
SSDEEP

12288:ah0kQqt4N3ATgOnr1UUES3d9PKrPAQ1tQWTHJQcNG/t:ah0QrBnhUyddy1pTX6t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c25e10a3e25c6b3b96789a52d6fe3048_JaffaCakes118

Files

c25e10a3e25c6b3b96789a52d6fe3048_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a7bb4744a330d0d447c41ee8931dc5c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
LoadLibraryA
CreateFileA
CloseHandle
GetCurrentProcess
ExitProcess

user32

CloseWindow
SetWindowLongA
wsprintfA
CreateWindowExA
CharLowerBuffA

advapi32

RegOpenKeyA
RegCloseKey
RegEnumValueA
RegQueryValueA
RegCreateKeyA
RegDeleteValueA
RegSetValueA
RegEnumKeyA
RegDeleteKeyA

Sections

.text
Size: 409KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ