JaffaCakes118_1ed48ba3fed158709bd80e741bc3907a | Triage

Sharing

General

Target

JaffaCakes118_1ed48ba3fed158709bd80e741bc3907a
Size

176KB
MD5

1ed48ba3fed158709bd80e741bc3907a
SHA1

adfb55e8a3fbd42fcbc67e5949c0738a803ce84d
SHA256

a42cab05e3de77a326b30ec52fd873bbff69c2ae0b3eadcc655786ed359a4110
SHA512

f33ee58afc178b9b73c5e08ffa9f67994875548cc9fdadb84653573a80a864cd60bd6ef01281cc7992049ea1ef798f8cda46468b1f7bd593723bfa9680e1782f
SSDEEP

3072:Vvre8ePeZj/xnHo9Y1mR2CAQZLigG3IaXfekoFSiK79Ov3yfapJJMW:8PeZj/xnI9Y1fOc3IIfeRDOgv3+K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_1ed48ba3fed158709bd80e741bc3907a

Files

JaffaCakes118_1ed48ba3fed158709bd80e741bc3907a
.exe windows:4 windows x86 arch:x86

2207cf4273b6ae73ffec434b1075439c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetThreadPriority
LoadLibraryA
TransmitCommChar
InterlockedDecrement
EnumResourceNamesW
ExitProcess
FreeLibrary
GetProcAddress
LoadLibraryW
InterlockedIncrement

advapi32

RegCreateKeyExA
RegCloseKey
RegQueryValueExA

user32

GetClassLongA
CharNextA
GetKeyState
CharLowerA

msimg32

AlphaBlend
TransparentBlt

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ