d3aaf69445417402370697931297ffe8_JaffaCakes118 | Triage

Sharing

General

Target

d3aaf69445417402370697931297ffe8_JaffaCakes118
Size

600KB
MD5

d3aaf69445417402370697931297ffe8
SHA1

21986c881b2504fcd5528ee3e70b1f147dc7dfba
SHA256

2b88d74eb1e419d74666d44d76517b75dc2e738e16a304a183331f459a410f3c
SHA512

bc0db487870d3afd9e4195f34133eb73e4dce9b7266635fe1d414bf1be7d6cc13350ef492fbb5b418cba3934320caf3db92926d29752bfcb6bb588066c5387c7
SSDEEP

6144:gIhdZDC4W0ZCAxOUvZaa/ngjyqszYKWcox9jPmyWDYOxVOJyekRVwSQNCDIJLup1:pZxRYTYguqwyDjOVbvVTXzxp1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3aaf69445417402370697931297ffe8_JaffaCakes118

Files

d3aaf69445417402370697931297ffe8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8d0ea57082aae6b3da0ee0cea50910d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
ExitProcess
GetCurrentProcess
CloseHandle
CreateFileA
LCMapStringA

user32

CharLowerBuffA
CloseWindow
wsprintfA
SetWindowLongA
CreateWindowExA

advapi32

RegEnumKeyA
RegCreateKeyA
RegOpenKeyA
RegSetValueA
RegCloseKey
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueA

Sections

.text
Size: 580KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ