f3081789276e612fe1be31893ef97670_JaffaCakes118 | Triage

Sharing

General

Target

f3081789276e612fe1be31893ef97670_JaffaCakes118
Size

428KB
MD5

f3081789276e612fe1be31893ef97670
SHA1

6fe24da86139379f3425264c3b99e652efba3ad3
SHA256

90403cfca4bbbb8845101fad657ed47dce656aa2f3d332284e03f69325e950f8
SHA512

c3d9aa6df7a815e2323b6f774e6f36d583a52b7c59f98d958863551c5e58cdeec7cd748dd8f2d0d4d087928187ff9964bdd706ceca8d18f4c093a8b61ef03a61
SSDEEP

12288:gDEwAQkxvEFI5wkYCoJoAQ48l4ewCN3EMF:gDEQwvyd7JtV8yehUMF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3081789276e612fe1be31893ef97670_JaffaCakes118

Files

f3081789276e612fe1be31893ef97670_JaffaCakes118
.exe windows:4 windows x86 arch:x86

158b9c744d6ab139720e02f2bcd16322

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
LCMapStringA
CloseHandle
GetCurrentProcess
ExitProcess
LoadLibraryA
CreateFileA

user32

wsprintfA
CreateWindowExA
CloseWindow
CharLowerBuffA
SetWindowLongA

advapi32

RegCloseKey
RegQueryValueA
RegSetValueA
RegCreateKeyA
RegOpenKeyA
RegEnumValueA
RegDeleteValueA
RegEnumKeyA
RegDeleteKeyA

Sections

.text
Size: 384KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ