01a2c6d601e1c82059540896de49bc55_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01a2c6d601e1c82059540896de49bc55_JaffaCakes118
Size

496KB
MD5

01a2c6d601e1c82059540896de49bc55
SHA1

b804e26f8f4cd99478cf8581518e0479fa5422a7
SHA256

56211ec94b20327ccfff99b140967d1373f42b58ed2959c89b9bb77853303d39
SHA512

fcf9142738a993bd1a0f055111139176765998a78c2748397bd0d2ccc7710c5b657392f32a6ada984941813e9b52d038870d964157b89698f97ee089a2fd9a78
SSDEEP

12288:xFwwEcFEjqAZ8BCusyjrwVcQmCkT2vlXm23aU5mOB:xFoGAZ8M7y/wFmR2XpqUfB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01a2c6d601e1c82059540896de49bc55_JaffaCakes118

Files

01a2c6d601e1c82059540896de49bc55_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4abee0de95257e84cd759e35c5f24a6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
LoadLibraryA
GetCurrentProcess
ExitProcess
LCMapStringA
CloseHandle

user32

SetWindowLongA
CreateWindowExA
CharLowerBuffA
CloseWindow
wsprintfA

advapi32

RegOpenKeyA
RegQueryValueA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegSetValueA
RegEnumValueA
RegCreateKeyA
RegCloseKey

Sections

.text
Size: 478KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ