434c3c6ba1d80d0b3a7000019fbddb8d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

434c3c6ba1d80d0b3a7000019fbddb8d_JaffaCakes118
Size

441KB
MD5

434c3c6ba1d80d0b3a7000019fbddb8d
SHA1

8f7e88d38ee20a47023f9a3668897463fc707b5e
SHA256

4f4b0fd3a7e057c57930b35e5e815e63c4b0019e4e5341dd54dbc7b5a66737d6
SHA512

4008c32f177709870c1ac0450a0a7d8184617032f73f16606766a037d6d934348b3f45dbcf2e82532ef201528ad9569039de112e515df820b8774ebd650254e4
SSDEEP

12288:UR4SV1ysOpTUfrGYwSfVi8RQfTdxylxyu:FVJpYfzE+qq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
434c3c6ba1d80d0b3a7000019fbddb8d_JaffaCakes118

Files

434c3c6ba1d80d0b3a7000019fbddb8d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9c34d78a9611fdc853d42e4b3c55c4b6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMessageA

advapi32

IsValidSid

ole32

CLSIDFromProgID

ws2_32

socket

shlwapi

PathFileExistsA

dnsapi

DnsQuery_A

shell32

SHGetSpecialFolderPathA

msvcrt

__CxxFrameHandler

oleaut32

LoadTypeLi

Sections

.text
Size: 412KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE