cf9ef628291450439fc12e89f0177501_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf9ef628291450439fc12e89f0177501_JaffaCakes118
Size

45KB
MD5

cf9ef628291450439fc12e89f0177501
SHA1

3954a62efb5fe1fe7af32b3c007ea171f5ca1b01
SHA256

86ac1b2c7dd0c092d2b5da47d219bfca7a1c2ebc15995c52cce4cb4eff59a19b
SHA512

d6cdff80871d7858ff1e7a6e5a617a47c47ab09f942a78ba332973fd3ef904e02ac1749d1abd3b49f43d48ddb9e1d32b6c5ef849e7c8d324d5ba92e084565e0e
SSDEEP

768:AkSNJoSimz6l8un01o+tNW9hSovWEpEvIgXnC6ADQh:ACSib8ugo+W9I/+EzC6Jh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf9ef628291450439fc12e89f0177501_JaffaCakes118

Files

cf9ef628291450439fc12e89f0177501_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a04bfd3d79c64277db8facb455ab63dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetModuleHandleA
FindResourceA
FindAtomA
AddAtomA
ExitThread
SizeofResource
LoadResource
LockResource
GetProcAddress
FreeResource

user32

VkKeyScanExA
WinHelpA
VkKeyScanA
TranslateMessage
ValidateRect

advapi32

RegSetValueA
CryptGetUserKey
CryptDeriveKey
RegOpenKeyA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ