9e06163d150b70aaa98112d74e300557_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9e06163d150b70aaa98112d74e300557_JaffaCakes118
Size

261KB
MD5

9e06163d150b70aaa98112d74e300557
SHA1

c228fa93acb0e9052d523eafde4a2abc863a5894
SHA256

30777f8c01f14bcb72705b787bbc5bf7439e85c595f433e291ce892409fef2c6
SHA512

b4617e2281c8f82414f6f58bdba7d14c8d377a502f7bcc13d7bb5393db015c9222cca6284918677486a44908e5f7068e7c7850697f6bb371bed3cfd30017ff33
SSDEEP

6144:rICpWh9WwggZ1F+bgvT0BXbpGQhSRHZevnPcIPpH4YGigobrWL/ezs6goZbk:5pF1MD+bgvABXb6HZeTpYitdzvtA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Product.Key.Explorer.1.8.7_CRKEXE-FFF/ProductKeyExplorer.exe

Files

9e06163d150b70aaa98112d74e300557_JaffaCakes118
.zip
Product.Key.Explorer.1.8.7_CRKEXE-FFF/FFF.NFO
Product.Key.Explorer.1.8.7_CRKEXE-FFF/FILE_ID.DIZ
Product.Key.Explorer.1.8.7_CRKEXE-FFF/ProductKeyExplorer.exe
.exe windows:4 windows x86 arch:x86

ee797162e719c79b9d4eebfce4801672

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

advapi32

RegEnumKeyExA

comctl32

ord17

gdi32

SetMapMode

mpr

WNetCancelConnection2A

oleaut32

SysStringLen

olepro32

OleCreateFontIndirect

shell32

ShellExecuteA

user32

RegisterClipboardFormatA

wininet

InternetReadFile

winspool.drv

OpenPrinterA

wsock32

gethostbyname

comdlg32

GetFileTitleA

ole32

CoTaskMemAlloc

oledlg

OleUIBusyA

Sections

.text
Size: 239KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
keygen.nfo