db83044597e2b12bd8cf9a12d4870cce_JaffaCakes118 | Triage

Sharing

General

Target

db83044597e2b12bd8cf9a12d4870cce_JaffaCakes118
Size

1.2MB
MD5

db83044597e2b12bd8cf9a12d4870cce
SHA1

ead58ccb73af8b47bcdce50eb43525d3d5aea65e
SHA256

9b3acae6a6738003aa758af3e6a7c17164fb8f97b83df395a06d74e642db6992
SHA512

f61071eee3c48ac15769f8f850cb7eddf0dc47b9ca4a281cdc0af81b72bc5190099d01b126145d1a1ed0e5c7e3b33878d0a81b1d038372e44fa356db281cd8ea
SSDEEP

24576:uUZVeIOWJRH814FaLwNAQUQjC05y37G9vH9XimKJY85iMUEIs7YuPCp7Bb/W/+lU:uUZgduRutLwOcjCD36f9XimKJYGtTap4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db83044597e2b12bd8cf9a12d4870cce_JaffaCakes118

Files

db83044597e2b12bd8cf9a12d4870cce_JaffaCakes118
.exe windows:6 windows x86 arch:x86

8064dd38ff82e991b27a6ec379b291f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
LCMapStringA
GetCurrentProcess
CloseHandle
LoadLibraryA
ExitProcess

user32

CreateWindowExA
CloseWindow
wsprintfA
CharLowerBuffA
SetWindowLongA

advapi32

RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegCloseKey
RegCreateKeyA
RegSetValueA
RegQueryValueA
RegOpenKeyA
RegEnumValueA

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ