0c1798f031f10f34bf4be53ab2f403e7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c1798f031f10f34bf4be53ab2f403e7_JaffaCakes118
Size

518KB
MD5

0c1798f031f10f34bf4be53ab2f403e7
SHA1

8b046696c938c111c2fde691bb734866bcb94158
SHA256

b4c9691d8fabeff743c473f5ba1c728f83b7226e63f0b2e8157f5519706a12d6
SHA512

c065ea982a86ad66407394c438456ce9dc50c0fe05f4cf41dee026ce0831e6dd70467f65217af66257416d416beb3f5491d34d73aec5d238b952661279ce5748
SSDEEP

12288:9lbVcJg/ZH4h6H2UmAeIwYOtEJ38ACLf2O9rlYM:9lbaGhwUiY+EN8ACrrlY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c1798f031f10f34bf4be53ab2f403e7_JaffaCakes118

Files

0c1798f031f10f34bf4be53ab2f403e7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9fa5d7c0df82105f2f437398f686e516

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetUserA

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

wininet

InternetReadFile

winmm

waveInUnprepareHeader

netapi32

Netbios

wsock32

WSACleanup

avicap32

capCreateCaptureWindowA

msvfw32

DrawDibDraw

urlmon

URLDownloadToFileA

ws2_32

gethostname

Sections

.nsp0
Size: 506KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE