15a9684206f661b435f522d39f6698d3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15a9684206f661b435f522d39f6698d3_JaffaCakes118
Size

17KB
MD5

15a9684206f661b435f522d39f6698d3
SHA1

2b1e0786b5faf1193b17b99652affb5bad8f44b0
SHA256

61668bad61363a93ed1f7820e0b5c4d3857bda098d49ed9fbac2e351a262787e
SHA512

62cd99ab339da04e394db30bdd88b584276ce7e9ae0ab93c63cbfb609d71b03a120ae4d829782022fe9796cfc32fc6a3c741a63de6b8a2e40a79cca8287b09a1
SSDEEP

192:P+LH9ajQjVbedilGAcLNIe7BwxY/5QDLg:a96QhidilIBBwxY/5MLg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15a9684206f661b435f522d39f6698d3_JaffaCakes118

Files

15a9684206f661b435f522d39f6698d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4a9e95eb593ec591628542912958db3a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
FormatMessageA
GetLastError
SetLastError
VirtualAlloc
CloseHandle
MapViewOfFile
CreateFileMappingA
VirtualFree
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameA
GetModuleFileNameW
GetVersionExA
VirtualQuery
SetFilePointer
ReadFile
CreateFileA
UnmapViewOfFile
WideCharToMultiByte
OpenFileMappingA
GetCurrentProcessId
LoadLibraryA

user32

MessageBoxA
MessageBoxA

advapi32

RegQueryValueA

Sections

.text
Size: 16KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE