28ff938f1ce6d4b53b763711974dcde0_JaffaCakes118 | Triage

Sharing

General

Target

28ff938f1ce6d4b53b763711974dcde0_JaffaCakes118
Size

183KB
MD5

28ff938f1ce6d4b53b763711974dcde0
SHA1

3021290b88fa769ad731996c654631f9d684b92f
SHA256

c0e10adab1cc30da76c87a66a0f75f309b8f75d84c191b5093f58e49b41745e0
SHA512

6269e35c1090b1f17412082911f4c901e88660b206eba7dc7bffa5ec3902ea3716361e38cac323995970118fa0e9c6f4ab3871fce8f639f12af9bee75cce7d62
SSDEEP

3072:/v0Xi1G6p6Znn6DvIrpWj0xtyr3jJid9i4K8tHFYT19G1Oytb:f1G6p+n62pdxtO3jJim4HtHC19i7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28ff938f1ce6d4b53b763711974dcde0_JaffaCakes118

Files

28ff938f1ce6d4b53b763711974dcde0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

db2f48e97307fa0f291a9af67ec3be9d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
CharNextA
wsprintfA
GetTopWindow
wsprintfW
GetKeyState
CharUpperA
CharLowerA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA

msimg32

AlphaBlend
TransparentBlt

kernel32

GetThreadIOPendingFlag
SetEndOfFile
SetStdHandle
FlushFileBuffers
CompareStringW
CreateMutexA
TransmitCommChar
CloseHandle
GetTempPathW
GetLastError
MultiByteToWideChar
EnumResourceNamesW
WriteFile
IsBadReadPtr
GetProcAddress
WideCharToMultiByte
GetModuleFileNameA
ExitProcess
InterlockedDecrement
FreeLibrary
CompareStringA
CreateFileW
LoadLibraryA
LoadLibraryW
InterlockedIncrement
SetEnvironmentVariableA

Sections

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ