e284a9a168cba4232197b43f94f2cabf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e284a9a168cba4232197b43f94f2cabf_JaffaCakes118
Size

200KB
MD5

e284a9a168cba4232197b43f94f2cabf
SHA1

c8532e050dfc5a15081ec6493dd64dd77b67e2a1
SHA256

bff133d7a3137411b4f6c0baa7ba1b9d2e760c0a0ea648f462ae700c6ee020e4
SHA512

879e739d47d7a5f2a493f950b16d9bf6bc9608cf2eb656c70f525f83d491ee07b07bcada805964a67c12173cd6211f6abb663f7fc97ff358c888b0bad59bbb5a
SSDEEP

6144:m4VvNyCWgjwzJbd4yqcTD2SqOxOS5PQRzOX2:VE5gEycTqwUOQpOm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e284a9a168cba4232197b43f94f2cabf_JaffaCakes118

Files

e284a9a168cba4232197b43f94f2cabf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

928f2698347f585dfe2f0300f9a27f73

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
LoadLibraryA
CloseHandle
ExitProcess
LCMapStringA
CreateFileA

user32

CreateWindowExA
CloseWindow
wsprintfA
CharLowerBuffA
SetWindowLongA

advapi32

RegSetValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegEnumValueA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegCreateKeyA

Sections

.text
Size: 160KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ