d9c41cb69efedaf4c306808fdd902a3a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d9c41cb69efedaf4c306808fdd902a3a_JaffaCakes118
Size

304KB
MD5

d9c41cb69efedaf4c306808fdd902a3a
SHA1

3254e19b68334e1958b5e89f4930daf8ea27a6f1
SHA256

4dd97f6bd30c95e6ab47eec42b6e093bfe4e344a6721e17ad5cb564623b1c8fb
SHA512

150aa2c05017a08e68dca0215dbabf64d41c55918769bc6af1580ec086a3d6e2701cc89e5ebe6b15a44126ade38e0d2588b1c91394b0fe005d9819bd23591860
SSDEEP

6144:nu/ydkV31uLAKOy9yl1N0GgVrmCylyKF5Q:nuugFaAVy9eHFv8mQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9c41cb69efedaf4c306808fdd902a3a_JaffaCakes118

Files

d9c41cb69efedaf4c306808fdd902a3a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4caaef16f3ffea530a1b8c5d03fd0ba9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
GetCurrentProcess
CloseHandle
ExitProcess
LoadLibraryA
CreateFileA

user32

wsprintfA
CreateWindowExA
SetWindowLongA
CloseWindow
CharLowerBuffA

advapi32

RegCloseKey
RegDeleteValueA
RegOpenKeyA
RegCreateKeyA
RegSetValueA
RegQueryValueA
RegEnumKeyA
RegEnumValueA
RegDeleteKeyA

Sections

.text
Size: 234KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ