705e374c49b73598bb278f75bd1b564c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

705e374c49b73598bb278f75bd1b564c_JaffaCakes118
Size

193KB
MD5

705e374c49b73598bb278f75bd1b564c
SHA1

e3f89af0a5a03d5a042fd88a8ff16d7c67282d0f
SHA256

4a8c36cf1793daef129d6c436b80813ccf9b402342ad8609767f057d47fba22f
SHA512

099ac98127de7904330ed0812b1d37db4de4b5ca2ea365b22ca1e0a02fac895142b87ee8df72f260cf7a1b18da6a64b83c2c2f14b882055964804f868322f12c
SSDEEP

6144:QAa3VzowuY6+sE5SpLyxemq7dJHOE/rIRU/PC1JK:QAalznuYH9SFyxemqRJHL/URU/PC1JK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
705e374c49b73598bb278f75bd1b564c_JaffaCakes118

Files

705e374c49b73598bb278f75bd1b564c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2b689ad026f6d524f574bdb7a17382af

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMessageA

advapi32

RegOpenKeyA

ole32

CLSIDFromProgID

ws2_32

socket

shlwapi

PathFileExistsA

dnsapi

DnsQuery_A

shell32

SHGetSpecialFolderPathA

msvcrt

malloc

oleaut32

VariantCopy

Sections

.text
Size: 181KB - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE