c93747f8b88c08bf83fe79c0314873be_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c93747f8b88c08bf83fe79c0314873be_JaffaCakes118
Size

300KB
MD5

c93747f8b88c08bf83fe79c0314873be
SHA1

c8fcc9cbf6308bb879977d7b7f6340c5add19d91
SHA256

258221aff2cb09f1b3a22e89783a4c8fa7f6f2953fa9c86cdc7e4747bd7ad72a
SHA512

bd7f6d402c5a27db32f7c7ea7a60667086aa04cfd01e608d35aa143adb025243992eb75d9984f0cee4d1da2f6e87e7e52dcbac5c5c6e65bbb4b365433920ade4
SSDEEP

6144:jri1IzOUWDu1GfjLQQoLkYiqDZkOG4/PZrT3PA:S1IzOUL1GQQoKq9LHZfA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c93747f8b88c08bf83fe79c0314873be_JaffaCakes118

Files

c93747f8b88c08bf83fe79c0314873be_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d64a6ed686a053bb2692058b40f6a844

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
ExitProcess
CreateFileA
LCMapStringA
LoadLibraryA
CloseHandle

user32

wsprintfA
CreateWindowExA
CharLowerBuffA
CloseWindow
SetWindowLongA

advapi32

RegSetValueA
RegDeleteKeyA
RegOpenKeyA
RegEnumValueA
RegDeleteValueA
RegQueryValueA
RegCloseKey
RegEnumKeyA
RegCreateKeyA

Sections

.text
Size: 277KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ