d2bf927df485d6aa857209e427795ea6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2bf927df485d6aa857209e427795ea6_JaffaCakes118
Size

200KB
MD5

d2bf927df485d6aa857209e427795ea6
SHA1

24b21591a3b9db448ef25669016082a6522a4118
SHA256

08f75bf2729b43eaa4c8db4c0d3570975ba2138d2a06b15ebd44802435e03db6
SHA512

7152fb614a4dc308821968f7b12e114fd711864d5b30b3ee435abf947967dac5ecda5d3adcd6d62194a26a9e4ebd04f88158f0369afe336d95486a1e937866c4
SSDEEP

6144:DQg18vPNsTVdhRCD4czrYzebDi9G6rCdn8:0guvObC8cTboZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2bf927df485d6aa857209e427795ea6_JaffaCakes118

Files

d2bf927df485d6aa857209e427795ea6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

be300dbb63292c4f55a1ba421146c8f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
GetCurrentProcess
LoadLibraryA
CloseHandle
CreateFileA
LCMapStringA

user32

wsprintfA
SetWindowLongA
CreateWindowExA
CharLowerBuffA
CloseWindow

advapi32

RegOpenKeyA
RegDeleteValueA
RegSetValueA
RegQueryValueA
RegDeleteKeyA
RegCloseKey
RegEnumValueA
RegCreateKeyA
RegEnumKeyA

Sections

.text
Size: 181KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ