17e84c843616f67cad862a51428b1a5b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17e84c843616f67cad862a51428b1a5b_JaffaCakes118
Size

100KB
MD5

17e84c843616f67cad862a51428b1a5b
SHA1

64264341df722c085d7d196db122a9089347e2af
SHA256

1f42f3587a3b0c2b443e3d4c232d8cf19759c38211c166536ec7104b0d9041ee
SHA512

1b93d3136370bcdadbbe6fd367d278a9eb3ee9f98e1821acd360602be71ae6835acb074e19415f4eee09c24e5e85c1fe0b13afda14d2e5f2405dfa6adcf8f98d
SSDEEP

1536:eoEhP+5nKQbrkr/C50yhoHpsBETyKxszhYCt41UmthvMYYhaVSu6E85MrKemh6Jc:efh2cq50xGOeKGSthE/3E85Me1MJrw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17e84c843616f67cad862a51428b1a5b_JaffaCakes118

Files

17e84c843616f67cad862a51428b1a5b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

de6fdcdc7f4ad649a7529bf91b3c3b02

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

ws2_32

WSCInstallProvider

Sections

.code
Size: 95KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE