d3585df4736b70bf63308e43cd9ce006_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3585df4736b70bf63308e43cd9ce006_JaffaCakes118
Size

176KB
MD5

d3585df4736b70bf63308e43cd9ce006
SHA1

eea32e74e25bf8d693455aa6457e42b35ef62219
SHA256

087a64de4c1bab6d48df1f88cd926a250cf324e0d10eda2e5609c509448b8616
SHA512

53797f583a28a0941e750124530c3312d0fe026047c39492c120bb5e67bb0fd0c6f7477dab068114237cab1946aacad1759e548576d512203a7e33f9be56fcd7
SSDEEP

3072:mpvusarMSv9bwx3KR1VCnBFxO8BE9HIEeC+Q0X+QEXEGh4HFINURgKQ0P:Kvu9rvVy3A1qxWIEfsXmXEK4lIGGK5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3585df4736b70bf63308e43cd9ce006_JaffaCakes118

Files

d3585df4736b70bf63308e43cd9ce006_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7b07f51abf2fc21e5bc5666a22096454

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
ExitProcess
LCMapStringA
GetCurrentProcess
LoadLibraryA
CloseHandle

user32

wsprintfA
CharLowerBuffA
CloseWindow
CreateWindowExA
SetWindowLongA

advapi32

RegDeleteKeyA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyA
RegOpenKeyA
RegSetValueA
RegQueryValueA
RegEnumKeyA

Sections

.text
Size: 158KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ