fb6540642892f8cefb0376064e6b154a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb6540642892f8cefb0376064e6b154a_JaffaCakes118
Size

561KB
MD5

fb6540642892f8cefb0376064e6b154a
SHA1

ebf60747acf0024696c5690c58520aa9da1d45f1
SHA256

1dc6e0b40c00a0e6f97564cbfde8df6ca32c3044a65c011e748c50967d76e51d
SHA512

dc1b81a70909083baccb534e43f4a16179661b9978c44d67b0d97104da4a6776ec6926d7cc0136d988603fc7e79891cd40bd1934329bae233c044014501114c1
SSDEEP

12288:v9xlyBJFF831Ps9r1ZZ2FeIErNezU87fOUNmP3y:FyHmGsF9EeznfHNq3y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb6540642892f8cefb0376064e6b154a_JaffaCakes118

Files

fb6540642892f8cefb0376064e6b154a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

28a78807fdde0a488d6344f323d5b1a7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
LCMapStringA
CloseHandle
GetCurrentProcess
ExitProcess
CreateFileA

user32

CharLowerBuffA
wsprintfA
SetWindowLongA
CloseWindow
CreateWindowExA

advapi32

RegDeleteValueA
RegEnumKeyA
RegOpenKeyA
RegEnumValueA
RegQueryValueA
RegCloseKey
RegSetValueA
RegCreateKeyA
RegDeleteKeyA

Sections

.text
Size: 157KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ