f57646c0e7b15cc01beaced5bd27d6c8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f57646c0e7b15cc01beaced5bd27d6c8_JaffaCakes118
Size

160KB
MD5

f57646c0e7b15cc01beaced5bd27d6c8
SHA1

9e1022252b027df969b5dff9dc976092a3ac310e
SHA256

cb6935a04513e2b85bbcde6b4b291516ded0d999db91cdabc0c40000943e73c1
SHA512

7320833e99767346b0dbe9f32859b5d417297fe4c78bdb8751073ff93770860355a408b3294b197b6786e9cbe20c2ad3f1ce02c89bc0c12354beade969683935
SSDEEP

3072:F3GZPCZvokJo1BkpNEv/mlUVQnVAgmPMfx6UOOCv:F33wJBFvYVXH3OOCv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f57646c0e7b15cc01beaced5bd27d6c8_JaffaCakes118

Files

f57646c0e7b15cc01beaced5bd27d6c8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e0bff1ade164be3b96e07bb23f460919

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
LoadLibraryA
CreateFileA
CloseHandle
GetCurrentProcess
LCMapStringA

user32

CloseWindow
wsprintfA
SetWindowLongA
CharLowerBuffA
CreateWindowExA

advapi32

RegEnumValueA
RegDeleteValueA
RegCloseKey
RegSetValueA
RegEnumKeyA
RegCreateKeyA
RegQueryValueA
RegDeleteKeyA
RegOpenKeyA

Sections

.text
Size: 142KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ