1b022dfd512acaa888969eb2d40a9592_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b022dfd512acaa888969eb2d40a9592_JaffaCakes118
Size

3.3MB
MD5

1b022dfd512acaa888969eb2d40a9592
SHA1

84431bed5c3023f4a76bd4c8e3807e176cfc70cb
SHA256

e68e3c6965fded8c2544689fb32f3db2a2569e7f1460fe42d1b4f70d755619e9
SHA512

10b11e50c7bac90c4a48a2078fe90d39bbe7dd7de37cc960976a5b03e244b2cd9769eed06648c5151d6d12120f926c3ff4d2aa05c5e94f8df03e9981ec616ed3
SSDEEP

49152:rTVqQUU54NsQiGCyZhD+527U5fFyCgBJbte4a/wLURJL6MR3KincgHEG3HN:rTVT54SQs52w5fFyCg78drXKicgHzHN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b022dfd512acaa888969eb2d40a9592_JaffaCakes118

Files

1b022dfd512acaa888969eb2d40a9592_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f7c160e6486e1bd9ca4789af81fe20cf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileA

winmm

timeGetTime

Sections

CODE
Size: 3.3MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE