eb12c99bd1c7c82d7a22497e71cefd17_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb12c99bd1c7c82d7a22497e71cefd17_JaffaCakes118
Size

248KB
MD5

eb12c99bd1c7c82d7a22497e71cefd17
SHA1

d71076803fbd06ce9d619d07d3f0f7781a824b0d
SHA256

86831f62f037fc24d33ec93a9441176cade12fb75b341b2eee8dbb67a6665943
SHA512

a1a8618aa74c45d094c788930a52474c09767a68aeb3dcd77b2ea36a38974929c40d9fd2c0339126fab4b0fbe7ccd17720f395103eaf419a8a8b3e845a8d6875
SSDEEP

6144:2fb4lSmGhCxbVuflleeXNgeJ2SIBqBl8W0NyzV+o3AMDpzkVVtKT0bZkZgta2Al:2slahCZVofNgeABqz86B+o3A0Ozl8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb12c99bd1c7c82d7a22497e71cefd17_JaffaCakes118

Files

eb12c99bd1c7c82d7a22497e71cefd17_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e2bdef9ef1c66471a2dfb370278409f6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
CloseHandle
LCMapStringA
LoadLibraryA
GetCurrentProcess
ExitProcess

user32

wsprintfA
CharLowerBuffA
CloseWindow
CreateWindowExA
SetWindowLongA

advapi32

RegSetValueA
RegCloseKey
RegDeleteKeyA
RegEnumKeyA
RegCreateKeyA
RegEnumValueA
RegDeleteValueA
RegQueryValueA
RegOpenKeyA

Sections

.text
Size: 227KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ