e1f4df051b6804801db919c2d2a56c79_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1f4df051b6804801db919c2d2a56c79_JaffaCakes118
Size

480KB
MD5

e1f4df051b6804801db919c2d2a56c79
SHA1

fbe56ba208567219fe619528a642bbc9073d6c29
SHA256

a1a212285d45127ff8aff6ed393b6823aef2f1a9908daf66b7faacb1ed1f3d08
SHA512

be2803ceea34d8ae6616e55de332df1294473d2da09e1297ce54789c148c09a5376c1ba9cea3771ab3e77aa03ccc2960729f4ed26c739f17119ecf5921b5bfc4
SSDEEP

12288:gj1r+Z5iUsgZQ3HAKhQKupuFrGj8Op2lyeOqp+pr3L1KJ:y1rciUsoQ3HAKEuQFFBx70J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1f4df051b6804801db919c2d2a56c79_JaffaCakes118

Files

e1f4df051b6804801db919c2d2a56c79_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e7dff3101287bc8867e569b2c78fe5da

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
LoadLibraryA
GetCurrentProcess
CloseHandle
CreateFileA
LCMapStringA

user32

CharLowerBuffA
CloseWindow
CreateWindowExA
wsprintfA
SetWindowLongA

advapi32

RegDeleteValueA
RegCreateKeyA
RegDeleteKeyA
RegSetValueA
RegQueryValueA
RegEnumValueA
RegCloseKey
RegEnumKeyA
RegOpenKeyA

Sections

.text
Size: 462KB - Virtual size: 464KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ