fba69bc42ac1e02865b8fa2c732d9c9d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fba69bc42ac1e02865b8fa2c732d9c9d_JaffaCakes118
Size

45KB
MD5

fba69bc42ac1e02865b8fa2c732d9c9d
SHA1

c0e4f98b446d3f5e4caec40cb0087cce46f23b4b
SHA256

631fdda1ee6d451dc6a503d620cc6b8ddf93c87d5d126ab98624539ffa625bf5
SHA512

a36220a2016d32b35e403949cd70098c5497d1d922b7215ccce456d567e10e609990d681e7f175fc8a678083b2460a00dca04b0bd1e2fc100d9b76f8443f1fe8
SSDEEP

768:Yh2yzcHmdihuqOAn1eOIBhsHofnLylqMOvW6mHqt5Hkye9WpXyJv95A3CS:Yh2yzRW1fIL/2EMOkq7zpXyT5XS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fba69bc42ac1e02865b8fa2c732d9c9d_JaffaCakes118

Files

fba69bc42ac1e02865b8fa2c732d9c9d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e5e357c1817105e4965991996bf344db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
FindAtomA
GetProcAddress
ExitThread
VirtualAlloc
FreeResource
FindResourceA
SizeofResource
LoadResource
LockResource
GetModuleHandleA
AddAtomA

user32

wvsprintfA
TranslateMDISysAccel
WindowFromDC
UnionRect
UpdateWindow

advapi32

CryptDestroyKey
CryptAcquireContextA
RegSetValueA
RegQueryInfoKeyA
CryptEncrypt
RegFlushKey
CryptCreateHash

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 101B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ