db797501f76bd98d9b2a1a7f44e4ea98_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

db797501f76bd98d9b2a1a7f44e4ea98_JaffaCakes118
Size

404KB
MD5

db797501f76bd98d9b2a1a7f44e4ea98
SHA1

d6d84edae3504312897d973a2761113d6c4c5cee
SHA256

319f3d47a37a3163978e0359ab92e23ebcc2787d9cb766aceede2a4a88557ead
SHA512

82d3deb39eda97796854fd26d12994211def32cb9ab71d455cec416d99cccc455f2bd0d2288f1c0df3ae9c42250c67d740d3beceb51c8aa3e035b88749a93c83
SSDEEP

6144:ZtO8Bdg80+HtdJWrAS/ppUwxv33zKWbw5hRfhff2WHhL0Pp5Vi0o6pgjMpwCHBpl:ZI8EuHtvWrASrUCOW85hVhfhBL+rwap

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db797501f76bd98d9b2a1a7f44e4ea98_JaffaCakes118

Files

db797501f76bd98d9b2a1a7f44e4ea98_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f6917e615fde29a59f7af8fe8538d858

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
GetCurrentProcess
CreateFileA
ExitProcess
CloseHandle
LCMapStringA

user32

CloseWindow
wsprintfA
SetWindowLongA
CharLowerBuffA
CreateWindowExA

advapi32

RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
RegEnumValueA
RegQueryValueA
RegOpenKeyA
RegSetValueA

Sections

.text
Size: 381KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ