9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118 | Triage

Sharing

General

Target

9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118
Size

191KB
MD5

9595f24627dc2b8d0e3305ebc60dd424
SHA1

efd13f451f2d7df8bc5f1eeef00b8f0c99f47c65
SHA256

eb1ab3410743f955d78e984fa926c1794ac235f5b852a1bb14b66a6a1ccebb69
SHA512

45f5da36c878365b6a623a275a5ed670ec4c46418b1aa75f32f2642dcdf759ef1f37340f5e57c76749383d3a4de0b11ba67adf90270ba399db583c09d1b86a92
SSDEEP

3072:hvxwXAFqJNvYU6Kx72vo3WiKlrud4Kli/acnC9yGerfUQ9c:4XA2JYU+vVhlr64Kw/PCIGerf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118

Files

9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b0968692c230bf67377e80018868d950

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetKeyState
CharNextA
GetClassLongA
CharLowerA

kernel32

GetThreadPriority
GetProcAddress
SetCommTimeouts
VirtualAlloc
EnumResourceNamesA
ExitProcess
GetProcessHeap
LoadLibraryA
FreeLibrary
VirtualFree

msimg32

AlphaBlend
TransparentBlt

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ