ddf549445443389acd3800b71bc9ca00_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ddf549445443389acd3800b71bc9ca00_JaffaCakes118
Size

944KB
MD5

ddf549445443389acd3800b71bc9ca00
SHA1

d6e6cf1c450ab2d31f307e333a22b62525003d16
SHA256

c4f30a151e627a4b8df815b1dadfe2938552b4a35849c904348528245e5b4fed
SHA512

c7c5117c93ed49a487ffdb7e30e3cf4952324ef3e4b5c3c635b95509b6fa068ef0cc56f291d7e689b83c6b6bada74c269963dce174a2862e0d1e595f8cefc2af
SSDEEP

24576:EWGWRWdcp1WKzmY1sgkrFYWj8nK0lA8JWq+kZo+gpQbRTeEwpysdqQOGs:EWGWRzp1V6g88nKesv+3TeEw/qQC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ddf549445443389acd3800b71bc9ca00_JaffaCakes118

Files

ddf549445443389acd3800b71bc9ca00_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b422c8cf09df62ac2963c9074efea65c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
LCMapStringA
CloseHandle
ExitProcess
GetCurrentProcess
CreateFileA

user32

CharLowerBuffA
wsprintfA
SetWindowLongA
CloseWindow
CreateWindowExA

advapi32

RegSetValueA
RegQueryValueA
RegCreateKeyA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegOpenKeyA
RegEnumKeyA
RegEnumValueA

Sections

.text
Size: 926KB - Virtual size: 928KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ