230494776f121079134a91bab8053a96_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

230494776f121079134a91bab8053a96_JaffaCakes118
Size

151KB
MD5

230494776f121079134a91bab8053a96
SHA1

200848a6c8f3c262d87bd4e8a439ed381839e275
SHA256

98711ce13f9eaddb74f9f20815ce90f83726490d2ee972082fcdd8b25021af94
SHA512

d1f8e92f25f14f9a5c5626b0cf59a334c8ef913ab2db43941cb5f092b2376500d2237266ec5d88030fa8d088a5414fdc56ec2a654a8ae443ad1d1464b4d268c2
SSDEEP

3072:z4jqDOAnJZE+6vGMWq4E1wTakIfWeW2Fsn85bC6MfihrJ3z:zUDb+6Oq4E+TsDj3n3hJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
230494776f121079134a91bab8053a96_JaffaCakes118

Files

230494776f121079134a91bab8053a96_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d2bbddb8c010773f04c2d9dd29668462

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

Sections

CODE
Size: 140KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE