147fda2fb0fa6ee12eda3130d4f3bc90_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

147fda2fb0fa6ee12eda3130d4f3bc90_JaffaCakes118
Size

13KB
MD5

147fda2fb0fa6ee12eda3130d4f3bc90
SHA1

904985f82c423d420a143b0d9ca8d176736c582c
SHA256

f7a1e5a4d778fd7259785bdd8b6f7493dd6d5f40f8e547222d5ffa1022276aa3
SHA512

289c5c698da37d51d0ee3336e25f2833e5e0a67bcc08c73380c5d212991ba1c3d89cf8cf4341eccaebee9f6b2328a9a32fff63176f8cce46144ea3a106ea6598
SSDEEP

192:b3Z6L2rFMbM6KTSsWkUGuqXyHcskyD9vJ/8cm0q:LZ6uF+GWbZBLvD9x8cm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
147fda2fb0fa6ee12eda3130d4f3bc90_JaffaCakes118

Files

147fda2fb0fa6ee12eda3130d4f3bc90_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3a716057f28a9f59a90bdb063d0de580

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ilence/getunlock.php

Imports

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
VirtualQuery
GetModuleHandleA
SetErrorMode
CreateThread
HeapAlloc
Sleep
LoadLibraryA
ExitProcess
GetProcAddress
FreeLibrary
GetVersionExA
GetModuleFileNameA
GetProcessHeap
GetCurrentProcess
IsDebuggerPresent

user32

GetDC
GetMessageA
TranslateMessage
DefWindowProcA
RegisterClassA
DispatchMessageA
LoadCursorA

gdi32

GetDeviceCaps

advapi32

CloseServiceHandle
QueryServiceStatus
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
OpenServiceA
OpenSCManagerA

ole32

CoCreateInstance
CoInitializeEx
CoInitialize

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ