3e461754e06061f22bde9339e61f5544_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e461754e06061f22bde9339e61f5544_JaffaCakes118
Size

245KB
MD5

3e461754e06061f22bde9339e61f5544
SHA1

d921adfce2a41b48d51b07109bcf8c3294fee4fa
SHA256

fbcd861804c6edab155e11e4ffe0cf6e6238bbb57751c1b66b8aec565768f8a9
SHA512

f3b247f43ef2dfdab89bbba2abee49fe17e4ef6e080ef9c4a343831d1263b6642fec38d076df29122e48d4c50c8514dc2d6c9ab53f7c9c61bb4b0f0b7e74e409
SSDEEP

6144:eHpe94SKwFyHms/Um7lgbJ3NuJTqueRK1jGDV6A5uX:+e94ummsr7KbJ9b6rA5G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e461754e06061f22bde9339e61f5544_JaffaCakes118

Files

3e461754e06061f22bde9339e61f5544_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e77d83cde439d3aecb42aeb608f53474

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
LCMapStringA
LoadLibraryA
CloseHandle
GetCurrentProcess
ExitProcess

user32

wsprintfA
CharLowerBuffA
CreateWindowExA
CloseWindow
SetWindowLongA

advapi32

RegOpenKeyA
RegCloseKey
RegEnumKeyA
RegDeleteValueA
RegCreateKeyA
RegEnumValueA
RegSetValueA
RegQueryValueA
RegDeleteKeyA

Sections

.text
Size: 177KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ