d9f2ad385b86ff67d1a968ac81a47ed2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d9f2ad385b86ff67d1a968ac81a47ed2_JaffaCakes118
Size

196KB
MD5

d9f2ad385b86ff67d1a968ac81a47ed2
SHA1

ea0d56dac5ea6359b85b749398019098cd5d2af4
SHA256

04bd4d96b94be5ad165e0ac84a4f3cff0f48999f0d840eb219b0092c23cd8f78
SHA512

c8529b9cddbc866d20e5fd7af380609454651ed9fa887fddea210f4a65752c818cc9b5b8dfefab732297ebf730b894ecda26835ad9fe114a1081d7ec8eee232f
SSDEEP

3072:PgoD/rIV0/WQyQHpZf1bxSUt+JqoH7yPg62rB4JMUQvkli6JbzbhNM4aWegy:PgofYQWjQHpZuUAJqA7GgdBs5g6pDPaD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9f2ad385b86ff67d1a968ac81a47ed2_JaffaCakes118

Files

d9f2ad385b86ff67d1a968ac81a47ed2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a18c1d63699c1a3202ccdaf16c74ddd4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
GetCurrentProcess
LoadLibraryA
LCMapStringA
ExitProcess
CreateFileA

user32

CharLowerBuffA
wsprintfA
CreateWindowExA
SetWindowLongA
CloseWindow

advapi32

RegEnumValueA
RegSetValueA
RegDeleteValueA
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA

Sections

.text
Size: 179KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ