1007e73ac0d4c77e4c024d5a98193e08_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1007e73ac0d4c77e4c024d5a98193e08_JaffaCakes118
Size

245KB
MD5

1007e73ac0d4c77e4c024d5a98193e08
SHA1

124d471478c80a5aa8927683a8c93ffaf166b4ff
SHA256

a111becc952023db7ccb1a6c4362449786f76e9295f3c7772d217dfb7d740e76
SHA512

3c654156e4960aec7b720804692f42d4ffae20685908c5cff055dec1ea2cf1285fc4a8c4bb6c64c190a977cf87c88cb09ab71286c55eb7e03dbe40e09f2c4075
SSDEEP

3072:NSVAu/A6KhbQ3xHedKWSPtes6YkUEiOkS15Ld86TvpAapm8jYUqKfUCa4qYaT/i4:cVLcQhiktdxEp5PvGalYU/NqBVTEc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1007e73ac0d4c77e4c024d5a98193e08_JaffaCakes118

Files

1007e73ac0d4c77e4c024d5a98193e08_JaffaCakes118
.exe windows:4 windows x86 arch:x86

83e1f1a7d9e1decb29851c03a8dbde9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
GetCurrentProcess
CloseHandle
CreateFileA
LoadLibraryA
LCMapStringA

user32

CreateWindowExA
CharLowerBuffA
wsprintfA
SetWindowLongA
CloseWindow

advapi32

RegEnumValueA
RegOpenKeyA
RegQueryValueA
RegSetValueA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 146KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ