5d4e3d13bf938540a6af2ce4d198e9c3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5d4e3d13bf938540a6af2ce4d198e9c3_JaffaCakes118
Size

441KB
MD5

5d4e3d13bf938540a6af2ce4d198e9c3
SHA1

2c9c1a2161d47811585c73074271e7e6e2e6e56e
SHA256

055bf9f5e8aca04c66aeb0a1bddd93c4779fd82574c954ac6717fcfe9123120f
SHA512

304d0e9330ed76f1ba3acf75859dde07388c45f281a7888dad6a3c6642b9df37eccc8e168fc9447ced664b3f99c4bf59fc6213969fde3be006c06604a5ea5816
SSDEEP

12288:UR4SV1ysOpTUfrGYwSfVi8RQfTdxylxyB:FVJpYfzE+qV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d4e3d13bf938540a6af2ce4d198e9c3_JaffaCakes118

Files

5d4e3d13bf938540a6af2ce4d198e9c3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9c34d78a9611fdc853d42e4b3c55c4b6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMessageA

advapi32

IsValidSid

ole32

CLSIDFromProgID

ws2_32

socket

shlwapi

PathFileExistsA

dnsapi

DnsQuery_A

shell32

SHGetSpecialFolderPathA

msvcrt

__CxxFrameHandler

oleaut32

LoadTypeLi

Sections

.text
Size: 412KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE