e9ab494a77fbb9b982946619042c46eb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e9ab494a77fbb9b982946619042c46eb_JaffaCakes118
Size

48KB
MD5

e9ab494a77fbb9b982946619042c46eb
SHA1

7431e7a7441950a5522f93550a5cf87a3b77002d
SHA256

8b2328db256dcf7291feb4698ff0d95f9c74048c1f5c92e8b2743fe2ab7d7c12
SHA512

22f9794c8432bef74fc8636eb50b680f3c28a3794d377acec47272a0d3ba1d0e782fc5d46425fa0b170daf805f645cf1c7a5b59075e90639c853a71dc905e94c
SSDEEP

768:cD6Y8FtaJMXs1VUojQRoAb2vWiOUwx1t22Yml5k/Ma4oKr+xl+Vi:hPrR6VUaQ2AqvWiOBt2M5k/Ma4BkgVi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9ab494a77fbb9b982946619042c46eb_JaffaCakes118

Files

e9ab494a77fbb9b982946619042c46eb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ac670048bc28738e2b243bda13149b21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

wininet

InternetGetConnectedState

Sections

CODE
Size: 38KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE