d35b5b72b610fff63dbceb6a85986aac_JaffaCakes118 | Triage

Sharing

General

Target

d35b5b72b610fff63dbceb6a85986aac_JaffaCakes118
Size

176KB
MD5

d35b5b72b610fff63dbceb6a85986aac
SHA1

7395ddd77db1c367d1488d2ab9467872be7ac9d8
SHA256

906c8b2746a391d810aa553db452ef0de0697841bb95e9c1b318f50a901b318c
SHA512

8f60b80b48b423c87de34352657c734e2302cba488e307d887fc0c1796fbd67af46d1e1a2966318b3c3eb9e6bc7cf2df2a9e2d4e55bbe3e617e419a882f2a087
SSDEEP

3072:5vg6sleUykxTOR3uT76ui+RqRPkj3STUzBBrYnzsTsWtUBbgBjynC5++eAIR8GLB:e6IeU1+m6unRwsj37zBBEngUB8jCEHug

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d35b5b72b610fff63dbceb6a85986aac_JaffaCakes118

Files

d35b5b72b610fff63dbceb6a85986aac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e39221c6911624bcba0ee1eb85e23d7e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetTopWindow
GetKeyState
CharNextA
CharLowerA

kernel32

GetThreadPriority
InterlockedDecrement
TransmitCommChar
GetProcAddress
EnumResourceNamesW
ExitProcess
LoadLibraryA
LoadLibraryW
FreeLibrary
InterlockedIncrement

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

msimg32

AlphaBlend
TransparentBlt

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ