fe6398206a37312bd128f8abfd5a2424_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fe6398206a37312bd128f8abfd5a2424_JaffaCakes118
Size

46KB
MD5

fe6398206a37312bd128f8abfd5a2424
SHA1

6dd92ab6e9c2ffbffbd700a2b910a446fcf0c95a
SHA256

1513e08922fc040ad72d2e39e9c6c934913ee972b0a13354e5236edbd2a71ff9
SHA512

bd2d5f74acacbabd77a28f2b98698d7e42a2a2ca2d7d81ea39019b6ad1ef00d27b61d1c908d8d41eb7774181fff289b5c6021402ae1454a5e54bb5fcdd1bf778
SSDEEP

768:aHQJfqutyxMLB3A/JbecqIe3i1M5ICexsiVasBZVj0TKX3R9zerzL:Imyu+itL2eS1qgF0T63LzO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe6398206a37312bd128f8abfd5a2424_JaffaCakes118

Files

fe6398206a37312bd128f8abfd5a2424_JaffaCakes118
.exe windows:5 windows x86 arch:x86

dfdeea49c0f545e2f4a0f457a548cf9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitThread
AddAtomA
VirtualFree
FreeResource
GetProcAddress
GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
LockResource
VirtualAlloc
FindAtomA

user32

TranslateMessage
UnionRect
UnpackDDElParam
ValidateRgn

advapi32

RegSetValueA
CryptDestroyHash
CryptExportKey
RegDeleteValueA
CryptDestroyKey
CryptSignHashA
RegEnumValueA
RegLoadKeyA
RegFlushKey
GetUserNameA
RegCreateKeyA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ