389cc251fc7abc72c657f4fef71fbf85_JaffaCakes118 | Triage

Sharing

General

Target

389cc251fc7abc72c657f4fef71fbf85_JaffaCakes118
Size

2.0MB
MD5

389cc251fc7abc72c657f4fef71fbf85
SHA1

d94a11ef9ca135fb2bc1f7d5cbfab80f1ee36e86
SHA256

b900cc26681edda0d382f49f0c1af7d9761ebad7e56fd942ed71e3d87167e774
SHA512

e5e7d25e728e4c24af371e04d6227e545e9e12168a9ce4771b26015fa5f58041594b606db6e0e33f301c206c4a7f17e669894161337bdcdd643f384953061714
SSDEEP

12288:Odr7AqSwUvnhjDjP7GtslkDqrndmjtJCoIZhhidCGT2OVskYkVKYiB:sr7AqSwcjDrflwadmjt6ryihTkVKYQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
389cc251fc7abc72c657f4fef71fbf85_JaffaCakes118

Files

389cc251fc7abc72c657f4fef71fbf85_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d958b3a8b0c403892644b3e19456c3de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
CreateFileA
LCMapStringA
LoadLibraryA
CloseHandle
ExitProcess

user32

CharLowerBuffA
SetWindowLongA
wsprintfA
CreateWindowExA
CloseWindow

advapi32

RegQueryValueA
RegCloseKey
RegOpenKeyA
RegDeleteValueA
RegSetValueA
RegDeleteKeyA
RegEnumValueA
RegEnumKeyA
RegCreateKeyA

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ