56abc1ae36d441e3bdfd3d1bb5f5fbf1_JaffaCakes118 | Triage

Sharing

General

Target

56abc1ae36d441e3bdfd3d1bb5f5fbf1_JaffaCakes118
Size

436KB
MD5

56abc1ae36d441e3bdfd3d1bb5f5fbf1
SHA1

71423965a512e9dfd2e3dd8a9c0eb1213c2f81a1
SHA256

e6d0436c51cda7fe07b6ee9e6f658c4388a87469f7fb5b405f5d24d0420f9451
SHA512

8bf6f73b83169c1f3dd01ef6880d969292d2144eadc7fadd4e3df8985af31eb8e4b253b362e9add1562ba2b5643f0f1499492ef1fad9eedb15400e7bfefb3df4
SSDEEP

6144:KMJWZKBsoZVvMVCCHkbIofcFdqXaJ/i/8U/mrAP7HVV9g5N1tjYXv32ySxq29OBq:K7KBviDEEqcFdqKw0bAzm1tonSxqmOBq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56abc1ae36d441e3bdfd3d1bb5f5fbf1_JaffaCakes118

Files

56abc1ae36d441e3bdfd3d1bb5f5fbf1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e5b37c81696b5430869b2a90f8db083f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
LoadLibraryA
GetCurrentProcess
CloseHandle
LCMapStringA
ExitProcess

user32

CloseWindow
CreateWindowExA
wsprintfA
CharLowerBuffA
SetWindowLongA

advapi32

RegCloseKey
RegQueryValueA
RegEnumKeyA
RegCreateKeyA
RegOpenKeyA
RegSetValueA
RegDeleteKeyA
RegEnumValueA
RegDeleteValueA

Sections

.text
Size: 416KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ