18211805d3aa20f6100331c1dcf16aa3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18211805d3aa20f6100331c1dcf16aa3_JaffaCakes118
Size

43KB
MD5

18211805d3aa20f6100331c1dcf16aa3
SHA1

f230b1b3f09108006b77a12a018f0cf0f2a1a247
SHA256

7b3db359730d1da57336ace1a24f44f09dd545cb2f9fa051a2c92cff0eeed65f
SHA512

c392a30bdeb243d259a5b59d2be6bc6fe55c62fda2f5edcf8058879516f99c08bf62c68fa2d5815668c931753b713d580f77e42d964c25e1c709808f995f94ac
SSDEEP

768:KV16fVc5TemT35/UUTWZW6o7g0yk4bN1nK6luyqI0vlJOG/sbn9Dof:f2TemT35sWE08bjnK64rOx4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18211805d3aa20f6100331c1dcf16aa3_JaffaCakes118

Files

18211805d3aa20f6100331c1dcf16aa3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29d4d9a4e535bff721362e89820bef9e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 37KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE