0eb9efb1633e0458faaf0d3dede7472e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0eb9efb1633e0458faaf0d3dede7472e_JaffaCakes118
Size

1.8MB
MD5

0eb9efb1633e0458faaf0d3dede7472e
SHA1

6055a19077ee2742903750ac49863d77b09fc290
SHA256

db9d003ecf14f185e170db51867a3c167b477f1bcf6dd979ba7f66b2f0aad9b7
SHA512

d3e07786f826875c0e7dcdd8390d97a32be00034de8c3d238b38951188533841078780a5ee6a0c4e46127941e862673ed140571894cc794addb4c820c1db3c52
SSDEEP

49152:iRUIpPwxpz9tfCh9ttqsiz5T5HNvWX07YtsI6R5pzufim4bfy:iyIp4xpTf5si17w07YCBucbfy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0eb9efb1633e0458faaf0d3dede7472e_JaffaCakes118

Files

0eb9efb1633e0458faaf0d3dede7472e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

742688b8c4767adba3888cff9ea9c946

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

CharNextA

advapi32

RegCloseKey

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

SaveDC

ole32

OleDraw

comctl32

ImageList_Add

wininet

InternetGetConnectedState

Sections

.PACKMAN
Size: - Virtual size: 11.5MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.PACKMAN
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE