016c525a20d66612717967979dd7dba8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

016c525a20d66612717967979dd7dba8_JaffaCakes118
Size

131KB
MD5

016c525a20d66612717967979dd7dba8
SHA1

54bad6994021b4767432e2c0aa12a0b85e32c95e
SHA256

617abde1b0eec91e8920e2b261e71a4838377a92abaf059892ee4f278a5faba5
SHA512

02a68998cad9f8bf32da424bbbe3ce66f5b31fb8b38e874d4e0994fe833b53585fdb64994503f6b44a1ea4469406868dca0047b5bdf3af63312ca0ac92b51de9
SSDEEP

1536:rgVw5wkPBjEPghl49Y8hx9VkkcgOPlnwnGQUGXUGe8Ek:kVw5wkdEH9Y839eZwG3ACk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
016c525a20d66612717967979dd7dba8_JaffaCakes118

Files

016c525a20d66612717967979dd7dba8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ac670048bc28738e2b243bda13149b21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

wininet

InternetGetConnectedState

Sections

CODE
Size: 17KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE