cf986f603dffe3a589165b478f0822c5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf986f603dffe3a589165b478f0822c5_JaffaCakes118
Size

252KB
MD5

cf986f603dffe3a589165b478f0822c5
SHA1

129db82926ea709274e7da03a6360711e876a6e1
SHA256

e2220cf887da51144a8ea9933ec13ba3f411f78e399b138b4f4643315a902bd1
SHA512

539e124a7d760056d5dd019be659503ebcd1b4333df170fb10571588fdabd7e032fe31096a7d722af28cecf4ad13df4db5d0f6381fcd50187eec4491bc584fe2
SSDEEP

6144:nrfWBdFkfov1NHPuopwdRmBHt+nuJxYTKq1rwp25PRr:nGv1RPuoKkt/YTXJB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf986f603dffe3a589165b478f0822c5_JaffaCakes118

Files

cf986f603dffe3a589165b478f0822c5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b5c75073ed1b82a7b59fd30f0f120ddc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
CloseHandle
ExitProcess
LCMapStringA
GetCurrentProcess
CreateFileA

user32

CloseWindow
CharLowerBuffA
SetWindowLongA
wsprintfA
CreateWindowExA

advapi32

RegCloseKey
RegOpenKeyA
RegSetValueA
RegEnumKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyA
RegDeleteKeyA
RegQueryValueA

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ