e48a8945211daf8a7368ad66b762b53c_JaffaCakes118 | Triage

Sharing

General

Target

e48a8945211daf8a7368ad66b762b53c_JaffaCakes118
Size

437KB
MD5

e48a8945211daf8a7368ad66b762b53c
SHA1

577e4ae90b9c709c2c9e17f0ff9ae19decb6e0e6
SHA256

35fb0a401e0bb06083f53e92f5e169cddb31a41e488babc0a82ffec7717fbba9
SHA512

2bf0707e562a2cc075125359a1c3f867f6f4c77577d2c9bc101c35b6ac5018e14cdc55246d814b68a50ae8951edb48b3f0ca938dc04b2270cf6b00fab432c011
SSDEEP

12288:lqxKMyb+xVz7W/CFYRSszsFuXgDWGEJXtbS:lqxbfFszsFuXNGEBtG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e48a8945211daf8a7368ad66b762b53c_JaffaCakes118

Files

e48a8945211daf8a7368ad66b762b53c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

af2ee289e1d480f15fe227b349d9e487

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
LCMapStringA
GetCurrentProcess
CreateFileA
CloseHandle
LoadLibraryA

user32

wsprintfA
CloseWindow
SetWindowLongA
CharLowerBuffA
CreateWindowExA

advapi32

RegCloseKey
RegDeleteKeyA
RegEnumKeyA
RegSetValueA
RegOpenKeyA
RegEnumValueA
RegCreateKeyA
RegDeleteValueA
RegQueryValueA

Sections

.text
Size: 4KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ