1c78e3f67894b7b068316e976cabe996_JaffaCakes118 | Triage

Sharing

General

Target

1c78e3f67894b7b068316e976cabe996_JaffaCakes118
Size

395KB
MD5

1c78e3f67894b7b068316e976cabe996
SHA1

d90d3a191d454eb271916203738e81c1f0c0d882
SHA256

59f5871c0fdc6b0da59d2e340c1e992d32db17f753863358a469b3fc3275102c
SHA512

2d52fd28645dbb1f4ea83291ccaf8348ffd51da9ce52fe4b30057316951307692e00bb309406e9c1ed1da7b99f6c8c17b64386a2db9061f402e4394d9d8bd508
SSDEEP

6144:taYfxcx8J5uybal9CAig2df9dKWuOEyfFTRxnwffZ/TWu12BfcSn19H2:oaqxKMybb5KmHfF1xafdTihcSnDW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

1c78e3f67894b7b068316e976cabe996_JaffaCakes118

Files

1c78e3f67894b7b068316e976cabe996_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cfaca42da6e28b6951c2f2e6cab3dc7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
ExitProcess
LoadLibraryA
GetCurrentProcess
CloseHandle
CreateFileA
LCMapStringA

user32

wsprintfA
CloseWindow
SetWindowLongA
CharLowerBuffA
CreateWindowExA

advapi32

RegQueryValueA
RegCreateKeyA
RegEnumValueA
RegSetValueA
RegDeleteValueA
RegEnumKeyA
RegCloseKey
RegDeleteKeyA
RegOpenKeyA

Sections

.text
Size: 4KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ