f3d08f7d4351d5266f7fdad5d1d78374_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f3d08f7d4351d5266f7fdad5d1d78374_JaffaCakes118
Size

330KB
MD5

f3d08f7d4351d5266f7fdad5d1d78374
SHA1

952bae42d8c71e38eae52b2e7e4d159d75cc91bd
SHA256

cec2337fd338c41758ba127cb33a54373bf85531ca32cb856964c36cc943f7bf
SHA512

bf0e5beca9a18f76c76136328ac6c919e0f276692b89b2ceabf635d1d4e37690209ccc4147341b715c80aa0b04167e637848c99059d9a55f691b596edba2fe66
SSDEEP

6144:DJiGgc0v00go5pkEn5AT/F/4IdNPttF3hcXCpO1Wqi3aenHfUc6NmPZ:ViG49Jn5EFDBmXCKfe/BR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3d08f7d4351d5266f7fdad5d1d78374_JaffaCakes118

Files

f3d08f7d4351d5266f7fdad5d1d78374_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7b0e6fc5d948fe68a99e5beb8d65a3c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

gdi32

UnrealizeObject

shell32

ShellExecuteA

Sections

CODE
Size: 323KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE