15ba789c761f3dc7657c4c32fa20aec5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15ba789c761f3dc7657c4c32fa20aec5_JaffaCakes118
Size

185KB
MD5

15ba789c761f3dc7657c4c32fa20aec5
SHA1

555e8bec5c1934e3672e07e9a719b9c7d107e20b
SHA256

ceb60b6f6cb8492689f91dba3ce4154d100cc36eb0fc1dc7bad6ff3cd33fb733
SHA512

495a92f1ca390caa1062e891df2ad65d86c4eba6c3410e69893fe678a6b02df734e06dba066d354a7bb906d73dc84a08296e77a97491d7742f76bdd2ca2d50ff
SSDEEP

3072:e+cLzMl2rgE+QTuZwoAfng951LTMRY6PZZmEW1D+L4pJgEPeVJ0blmvLru9K9FgW:ejzMl2rJEwobfJqdzmE2+yCMlmzru9mL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15ba789c761f3dc7657c4c32fa20aec5_JaffaCakes118

Files

15ba789c761f3dc7657c4c32fa20aec5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

68d162307596ca464b87c17a0525d4d3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetUserDefaultLCID
ExitProcess
CreateFileW
GetModuleHandleA
SetStdHandle
Sleep
GetACP
TerminateProcess
GetVersionExA
GetDateFormatW
GetTickCount
GetVersionExW
GetVersion
VirtualProtect
GetOEMCP
GetStartupInfoA
LeaveCriticalSection
FreeEnvironmentStringsA
ExpandEnvironmentStringsW
SetConsoleCP
OpenProcess

msvcrt

__dllonexit
strchr

gdi32

Rectangle

advapi32

RegQueryValueExW

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 818B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 135KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ