d5eea94532c14962dd70afd695462792_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5eea94532c14962dd70afd695462792_JaffaCakes118
Size

1.0MB
MD5

d5eea94532c14962dd70afd695462792
SHA1

86f4f2fa4ff8b0c7c1191cccfe9456b7a1088355
SHA256

366ac6cc4a6dfde05f75f31d304e8293fc0742ef11bb1434bb3d45b3ec2e7a90
SHA512

052ed0f1085adbf489d015789b87edf33dfe390e0a7713400dac839ef5e0278738bb66bd39036673a1666a372227065b676c27ed73807f10d6adfb3bf0d8f7a2
SSDEEP

24576:lFiiXp3JlRCoXmNJBFPRd9jBw2wHDcRc0I4Fvtqc2Tk1H:DJlMgqt1F/m0xx0Ro1H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5eea94532c14962dd70afd695462792_JaffaCakes118

Files

d5eea94532c14962dd70afd695462792_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c817a8ece5e994d6c613a66b84ed85a3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
ExitProcess
LCMapStringA
CloseHandle
LoadLibraryA
GetCurrentProcess

user32

SetWindowLongA
CharLowerBuffA
wsprintfA
CreateWindowExA
CloseWindow

advapi32

RegSetValueA
RegCloseKey
RegDeleteKeyA
RegEnumKeyA
RegDeleteValueA
RegEnumValueA
RegOpenKeyA
RegQueryValueA
RegCreateKeyA

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ