17581410983044f2961a30d5f41893d1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17581410983044f2961a30d5f41893d1_JaffaCakes118
Size

456KB
MD5

17581410983044f2961a30d5f41893d1
SHA1

b1a6a00bc36d4d9c1447adf4016f6a917fcd0be4
SHA256

562746735a0d745d23f8a29a175a06d7469671c34e7169268c3cfb31946b8f0b
SHA512

a9b00c1166d347e05ec0b0a930041f000dc72ff0638bd8ff2cc6f29ee09ca405146a203bc78091baabfb417d4e379e42ae664653da3a12be0b2bce11fb72e4dc
SSDEEP

6144:3PwzrYTV8MEHGyLB9DFwSk6dk8DMPMfNDmtIMJYtEOwiig78bbry/+QxDyCJIUR9:VQHGaPD1k0xIGNDttP7cS/3xN10gFuUn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17581410983044f2961a30d5f41893d1_JaffaCakes118

Files

17581410983044f2961a30d5f41893d1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f43dcb387ce90c09ed94e923707075a3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualProtect
GetModuleHandleA
GetProcAddress

user32

CharNextA

advapi32

RegCloseKey

oleaut32

SysFreeString

mpr

WNetGetUserA

version

VerQueryValueA

gdi32

SaveDC

comctl32

ImageList_Add

shell32

ShellExecuteA

wininet

InternetOpenA

wsock32

send

winmm

waveInStop

avicap32

capCreateCaptureWindowA

msacm32

acmMetrics

ws2_32

WSAIoctl

Sections

.text
Size: 447KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

linghun
Size: 62B - Virtual size: 62B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE