296a51b27d9817697fe86b79abdd62d2_JaffaCakes118 | Triage

Sharing

General

Target

296a51b27d9817697fe86b79abdd62d2_JaffaCakes118
Size

245KB
MD5

296a51b27d9817697fe86b79abdd62d2
SHA1

11dca7e3fae24059a1abbe094694017c4f349208
SHA256

3d792c1c4670e3322af788a1251edd79c83b2b40b49365d73ced62711cc6798c
SHA512

921063a0d36dffc21c9ea9a3d38acc3e5bcaa62528b7a0a5bfdda39a8a2bb4b33abe83781067e7f5268f6f10cabbaf14f6558c327486b226340b28c824f2a9b0
SSDEEP

6144:N9C4TKalKRowInMiDbVt107CSiQUFyQhQW2rKqiax5cO:/C49SEMiDJ0p8DhKuzax5cO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
296a51b27d9817697fe86b79abdd62d2_JaffaCakes118

Files

296a51b27d9817697fe86b79abdd62d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ed47f0e6504d61e89919b7fc2070244a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LoadLibraryA
ExitProcess
GetCurrentProcess
LCMapStringA
CloseHandle
CreateFileA

user32

CreateWindowExA
CharLowerBuffA
wsprintfA
SetWindowLongA
CloseWindow

advapi32

RegCloseKey
RegOpenKeyA
RegSetValueA
RegQueryValueA
RegEnumValueA
RegDeleteValueA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyA

Sections

.text
Size: 203KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ