00502d8117325774994c09802b293215_JaffaCakes118 | Triage

Sharing

General

Target

00502d8117325774994c09802b293215_JaffaCakes118
Size

2.2MB
MD5

00502d8117325774994c09802b293215
SHA1

3fe63dbb540d40eb6ca5b47449dc6eb8c0b71724
SHA256

1195e3d5f6a847f70a46f657507575389546137c94f5b0b123adfd5a47461607
SHA512

706771455d5b8e331ad8a3c1df6b6a8a4e65657abf1bc1ee936d563f5309ab547c009e9e1e0c1c93988fb656666055531497dfaf1edb5fd3bab631d9cc41b3d6
SSDEEP

49152:ChF/tQ8pBpBI04yDKYOOxhEwasBeBZG/CFsQF8O:C3/uCQumY1PEwasqZ+Gs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00502d8117325774994c09802b293215_JaffaCakes118

Files

00502d8117325774994c09802b293215_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f4089fe30323b0998ab170aa1ab245a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

Sections

CODE
Size: 2.2MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE