29adb4a3b1714d732c4c8380a1a95792_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29adb4a3b1714d732c4c8380a1a95792_JaffaCakes118
Size

380KB
MD5

29adb4a3b1714d732c4c8380a1a95792
SHA1

d0d2606141c05b80cfa1d33d46090d8dd37dc528
SHA256

4516db369938f36715166b3ff3f51781432c2602b1d18cf4b73f1fd600495dcc
SHA512

98e31897150b9bb6bb20a7d78a52438f23f02c90b9fb70cef22a77595f22712636a6d52ce7ed22d94b22a016f60ad88a97d4a4219259824a5f4bd5612c3bb44b
SSDEEP

6144:bKka/AGFkUT/C9hf88CohhIKbfxWarN2708FWeVxGCbJcCCkkUEcTuqvviYOKgXk:b1a/fqbjh4art8xxBbJcC4UEcT/UhSTd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29adb4a3b1714d732c4c8380a1a95792_JaffaCakes118

Files

29adb4a3b1714d732c4c8380a1a95792_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5ea573ad63b9b5863761d0dfda23fa48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
LCMapStringA
LoadLibraryA
ExitProcess
CloseHandle
GetCurrentProcess

user32

SetWindowLongA
CharLowerBuffA
CreateWindowExA
CloseWindow
wsprintfA

advapi32

RegDeleteValueA
RegEnumValueA
RegOpenKeyA
RegQueryValueA
RegSetValueA
RegCreateKeyA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey

Sections

.text
Size: 257KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ