fd97d9206f1f1a9013d24fff64b0d78c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fd97d9206f1f1a9013d24fff64b0d78c_JaffaCakes118
Size

212KB
MD5

fd97d9206f1f1a9013d24fff64b0d78c
SHA1

5ade5208ed545997578ce78f8168d79a5875a205
SHA256

e428fdf93ae3348fe8e09e6c879ed1fece1b5d68ca05ad9dd4880b7a3808b43e
SHA512

bdc969008dd8509a271854fba8eaf22234643f6b25fdc4d2a693cde8da1000732218b8397240a4f40b423ba9fc128e83fcafbe84331c3a244f43e40ede94fd54
SSDEEP

3072:8R2NZAOyAy0RsItTYD3Tl8hxLBh774pnbIkAdlUuoeRQbMoXrtpAsB2aZsRSoqIp:2KAOyAVRxtsDDqLX7kOhSX2amvmQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd97d9206f1f1a9013d24fff64b0d78c_JaffaCakes118

Files

fd97d9206f1f1a9013d24fff64b0d78c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

890939064900313069b6039dbf4b431f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
LCMapStringA
CloseHandle
LoadLibraryA
CreateFileA
ExitProcess

user32

CloseWindow
CreateWindowExA
CharLowerBuffA
SetWindowLongA
wsprintfA

advapi32

RegQueryValueA
RegDeleteKeyA
RegSetValueA
RegDeleteValueA
RegEnumValueA
RegOpenKeyA
RegCreateKeyA
RegEnumKeyA
RegCloseKey

Sections

.text
Size: 179KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ