156d450779a49e66df01aaaabc4c469d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

156d450779a49e66df01aaaabc4c469d_JaffaCakes118
Size

174KB
MD5

156d450779a49e66df01aaaabc4c469d
SHA1

59dad933b3709d119ac245dfef01782f4b8054a8
SHA256

a3cbe6a8a5d0b6c721ab15631fe3c93c085814c97560050eb47a052c2a036d56
SHA512

65b9833c3c9b645a3fac8b2f4da7d40a0895b465255570f12493a1f5cafc79b00a415dc3eefd63d063ca27bdfd679cff82529202a4bbb1cccfeee1867cce9f03
SSDEEP

3072:FvoLwEjiV16PBWozXe8ACiEau3+WRppflKBZUQz2775lB1FDbrRkTwcgVW+ge:ABWjelau3+WR7A0QadPRkTwcD+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
156d450779a49e66df01aaaabc4c469d_JaffaCakes118

Files

156d450779a49e66df01aaaabc4c469d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d4dac4dfe466cfeb4eb9c37d7b39f8d0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

AlphaBlend
TransparentBlt

user32

GetKeyState
CharNextA
GetTopWindow
CharLowerA

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

kernel32

GetThreadPriority
LoadLibraryA
TransmitCommChar
FreeLibrary
EnumResourceNamesW
ExitProcess
LoadLibraryW
GetProcAddress
InterlockedDecrement
InterlockedIncrement

Sections

.text
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ