06e803314f68d0cfd75d6d5c6df0be6d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06e803314f68d0cfd75d6d5c6df0be6d_JaffaCakes118
Size

563KB
MD5

06e803314f68d0cfd75d6d5c6df0be6d
SHA1

a1c46f0f0bf78375a903f13dbd8455bbe8f49fb5
SHA256

db34b9660897c55aae85835f1e7dc9eaca4a6520dc915ce011e1dcc501f85bcb
SHA512

1d245211ac3a500b755f03fa85dd8ed4cd7987b51f37ea80065a1501a781d22991ef2c61c051b0a5fb05f170cd496d77291dbe59a74492f727b82a967520d8a3
SSDEEP

12288:rlRFii5qeRcNPM4zDZaG2Dv/pLXx3eVZI2u5HdCQWiwf8T:h7dcvPZa7Dv/pTx0ZIJ59U8T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06e803314f68d0cfd75d6d5c6df0be6d_JaffaCakes118

Files

06e803314f68d0cfd75d6d5c6df0be6d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6e7e547be685efc8cdae6dd033e27e7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

mpr

WNetCancelConnection2A

comctl32

_TrackMouseEvent

wininet

HttpSendRequestExA

shell32

ShellExecuteExA

comdlg32

GetSaveFileNameA

Sections

.text
Size: 454KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 107KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE