0476562b62566ab718a1347364b27286_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0476562b62566ab718a1347364b27286_JaffaCakes118
Size

441KB
MD5

0476562b62566ab718a1347364b27286
SHA1

6dd48a837e4a63e7129db79f87280d1b298cf660
SHA256

e09ccc7e4b37181064ae5e3861aebd8da0d7bb89551402700afaed40c0274e35
SHA512

3b3811b70be6bdcc985123b12c5c831fe3428133cb5a9565750c80598cd9fae49d9711bbd50d8a19a8ca3c3ecfa4425daa0635d1254afd1f905452b22aa907a0
SSDEEP

12288:UR4SV1ysOpTUfrGYwSfVi8RQfTdxylxye:FVJpYfzE+qC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0476562b62566ab718a1347364b27286_JaffaCakes118

Files

0476562b62566ab718a1347364b27286_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9c34d78a9611fdc853d42e4b3c55c4b6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMessageA

advapi32

IsValidSid

ole32

CLSIDFromProgID

ws2_32

socket

shlwapi

PathFileExistsA

dnsapi

DnsQuery_A

shell32

SHGetSpecialFolderPathA

msvcrt

__CxxFrameHandler

oleaut32

LoadTypeLi

Sections

.text
Size: 412KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE