d2b5450390ff600d00c96811c401fe5f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2b5450390ff600d00c96811c401fe5f_JaffaCakes118
Size

172KB
MD5

d2b5450390ff600d00c96811c401fe5f
SHA1

274a5b8c60976dae17cd4c15d1d066f925ddcc73
SHA256

f63dd06ea11f12530007293c2342f4b2468c00abc9ea580ab986d59fc68556cb
SHA512

b98157f951901674ac338ff6ff212f8e4a3076ed7341a14cd4b1f96330974fc09dce185d6ed89e2bb290bfcb20a542d1d88d875b1b257d6b87a6d19ce08a09c6
SSDEEP

3072:ARwN5XBhZMVz/0dmQCCEGk7JoUm44FXsEhk59En88y76AAwgQImVXDCs:ARm5uz/00VV78RFXsEL88G6AtrCs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2b5450390ff600d00c96811c401fe5f_JaffaCakes118

Files

d2b5450390ff600d00c96811c401fe5f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

43ffdceafa9b5f356c5f5f5e021a47cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
ExitProcess
CreateFileA
LCMapStringA
LoadLibraryA
CloseHandle

user32

CharLowerBuffA
CreateWindowExA
wsprintfA
CloseWindow
SetWindowLongA

advapi32

RegDeleteValueA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyA
RegCloseKey
RegSetValueA
RegEnumValueA
RegQueryValueA
RegCreateKeyA

Sections

.text
Size: 122KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ