d02c6a1c08633d671a9fd67af79881e0_JaffaCakes118 | Triage

Sharing

General

Target

d02c6a1c08633d671a9fd67af79881e0_JaffaCakes118
Size

46KB
MD5

d02c6a1c08633d671a9fd67af79881e0
SHA1

b08425894187326a1903e07968f087a854259580
SHA256

24b5dc63212cc54f3a0dea08097f2bdd23ea10ff24b9791ca3e2b1ef86edd684
SHA512

1b62736651c59e66f3d573c0d27146c1f1ea7fc0e6dbba00dc5f22d401f73e7dac72d9380aeaaee926251af6bbc2a35a5a34027cf4f027b34d3086a0edf9021c
SSDEEP

768:bcyf6tF/N72yzJGwRwqGvW4GmGHzUPJWfHhSrQONjWQoeR+9PoOI7e/w6Gh:vCF/NKyzgmfGq8XN5gNIS/w6Gh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d02c6a1c08633d671a9fd67af79881e0_JaffaCakes118

Files

d02c6a1c08633d671a9fd67af79881e0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c9b6a9cc649160faf3dde84913457a10

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
VirtualFree
FindResourceA
SizeofResource
LoadResource
LockResource
FreeResource
AddAtomA
FindAtomA
GetModuleHandleA
VirtualAlloc
GetProcAddress

user32

UpdateWindow
UnpackDDElParam
UnloadKeyboardLayout
wsprintfA
UnregisterClassA
TranslateMessage
ValidateRect
VkKeyScanExA
UnionRect
wvsprintfA
ValidateRgn

advapi32

CryptGenKey
RegCreateKeyExA
CryptGetKeyParam
RegSaveKeyA
CryptSignHashA
RegQueryInfoKeyA
CryptDestroyKey
CryptReleaseContext
RegEnumKeyExA
RegQueryMultipleValuesA
GetUserNameA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 102B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ