f5a20f5c1d4a77c52916bc8878c86b6a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f5a20f5c1d4a77c52916bc8878c86b6a_JaffaCakes118
Size

420KB
MD5

f5a20f5c1d4a77c52916bc8878c86b6a
SHA1

32d45a79eca67e36db8c90430e2c4133e2ae9f0f
SHA256

97fa865726ae86397d31088f2825264fe9e25f114b4e3aa074aa41f7271cdc81
SHA512

0d1618a96c38cce9deb940ebc626d64d3649bd71923bbebdc23db584e87e3e7895a403d9816f76eae06d5f01e03b26bca03b49b3d6e0aa245aadcb8c7110a6c5
SSDEEP

6144:pr794+8+MipQ+hRgfHDJspqGmZKIilgb8oFiRDGDAxcVCb8QDF572rHSzkJdRrGH:pr7GX+PpQNf2GPbBFiRDjcVCB572r0Dv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5a20f5c1d4a77c52916bc8878c86b6a_JaffaCakes118

Files

f5a20f5c1d4a77c52916bc8878c86b6a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3c55b9849fc2dcdd6fd26498f8cc9bd3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
CloseHandle
LoadLibraryA
LCMapStringA
GetCurrentProcess
CreateFileA

user32

CharLowerBuffA
wsprintfA
CreateWindowExA
SetWindowLongA
CloseWindow

advapi32

RegOpenKeyA
RegDeleteValueA
RegCreateKeyA
RegSetValueA
RegEnumKeyA
RegCloseKey
RegEnumValueA
RegDeleteKeyA
RegQueryValueA

Sections

.text
Size: 392KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ