01ba5b93af930bf58e0d59dbfac38264_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01ba5b93af930bf58e0d59dbfac38264_JaffaCakes118
Size

2.9MB
MD5

01ba5b93af930bf58e0d59dbfac38264
SHA1

0987b585ea32a1abc4b5240913a2b08f0bbc8fd2
SHA256

f42fe690c1a751f46e76e4be760abe519f9d952142c59191225dda11564d0007
SHA512

623e90d3555fd7532558984015f23d0103184f2d1020f4c1e04cc673bf6a8272f31152a6ac1c72ebbfa39da4da2f6890dbe39acc704bbe8f66021e710787246e
SSDEEP

49152:1eHNFsyhdiAUxq1Lf+6gX7QlXGzuqJqlepURLn72Q+ZPrwc9M:gXsyhOK66U7QlXIuq4YSLn72lu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01ba5b93af930bf58e0d59dbfac38264_JaffaCakes118

Files

01ba5b93af930bf58e0d59dbfac38264_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b8182652b1539cc3d6888920c15a50d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
LCMapStringA
CreateFileA
LoadLibraryA
ExitProcess
GetCurrentProcess

user32

CharLowerBuffA
wsprintfA
SetWindowLongA
CloseWindow
CreateWindowExA

advapi32

RegSetValueA
RegDeleteValueA
RegEnumValueA
RegCreateKeyA
RegQueryValueA
RegCloseKey
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA

Sections

.text
Size: 512KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ