df40e8653aba8f25e01ede3c00524793_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

df40e8653aba8f25e01ede3c00524793_JaffaCakes118
Size

272KB
MD5

df40e8653aba8f25e01ede3c00524793
SHA1

dfb2a76772e8ac09086c3178200d6a7f9292e320
SHA256

c9fb5cea5fd13781f49b31192ecfa900317719b69a0f6bd063287cfb4cfdb179
SHA512

9eb5d65e0339f26e1c268a87e3c11710d47b333d1d4f259438e53d69a649c3e8bdb7527f851d7d909eef659feb23ef6319446e78edeacbd30618d4104052da3d
SSDEEP

6144:WxgB8uLtO3ET0SFmPrdITqO/Q28kD4iFlJMarTjY:wglxAEwwmDtookDRPSar4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df40e8653aba8f25e01ede3c00524793_JaffaCakes118

Files

df40e8653aba8f25e01ede3c00524793_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9d70e8e6291732ff76c12d436a901348

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
ExitProcess
CreateFileA
LoadLibraryA
LCMapStringA
CloseHandle

user32

CharLowerBuffA
CreateWindowExA
wsprintfA
CloseWindow
SetWindowLongA

advapi32

RegEnumValueA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueA
RegCreateKeyA
RegDeleteValueA
RegCloseKey

Sections

.text
Size: 253KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ