fc6f026d15788efeda98cba922e67daa_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc6f026d15788efeda98cba922e67daa_JaffaCakes118
Size

620KB
MD5

fc6f026d15788efeda98cba922e67daa
SHA1

3e926eae27a9be4f526df7b42f993eccfc8e43e5
SHA256

c4e4d9863a5495fb35bb08bd669880ba065564ee6bf00ff7345938ac9f249c08
SHA512

c687fbbb94edefd2e38ef70f00f80d03f26abaa0d1778c837a0eaf5192de90a84911728f8cca299f0a494db54a5a9505d8775afb38b1f7e3a5cf99f5bf88c81a
SSDEEP

12288:+XGpRLK9bkMQWeY4FHGpJVbwxZdA2r5atQhMqhHLZ:XpRLBAvlwxZ22ragN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc6f026d15788efeda98cba922e67daa_JaffaCakes118

Files

fc6f026d15788efeda98cba922e67daa_JaffaCakes118
.exe windows:5 windows x86 arch:x86

70348098482eb0043a667d96e872f63f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
CreateFileA
CloseHandle
ExitProcess
LCMapStringA
LoadLibraryA

user32

wsprintfA
CreateWindowExA
CharLowerBuffA
CloseWindow
SetWindowLongA

advapi32

RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegCreateKeyA
RegSetValueA
RegOpenKeyA
RegQueryValueA
RegCloseKey

Sections

.text
Size: 601KB - Virtual size: 604KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ