fe0da395d8398c1719fd3311768b287d_JaffaCakes118 | Triage

Sharing

General

Target

fe0da395d8398c1719fd3311768b287d_JaffaCakes118
Size

700KB
MD5

fe0da395d8398c1719fd3311768b287d
SHA1

395f6015200252476558c054094e7960454432e4
SHA256

b10c63ab3046e6e15376e7551a91bc237cd603d60faedf6369e151c051c9add7
SHA512

7828540be64cdedbd09f4efae3bd95f5d9e1c4d4ef802f4aae1f6b0f7d392902139153d8a4f888b9270224ce666b9623c1ef15754fc273f58c8c1be6a0ff3ed6
SSDEEP

12288:UiJno87rp4jb9LiC3eBC9DV1/2D/FYIAmLuT0WlubsrD:UiJt5A8Meqn/oYIBLub3rD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe0da395d8398c1719fd3311768b287d_JaffaCakes118

Files

fe0da395d8398c1719fd3311768b287d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

eb5be75c66b5fb7a05705d3a4b6378d0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
GetCurrentProcess
CloseHandle
LoadLibraryA
CreateFileA
ExitProcess

user32

CreateWindowExA
CloseWindow
wsprintfA
CharLowerBuffA
SetWindowLongA

advapi32

RegCreateKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegCloseKey
RegSetValueA
RegOpenKeyA
RegQueryValueA
RegDeleteKeyA

Sections

.text
Size: 674KB - Virtual size: 676KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 236KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ