2498f591eac727201c8b8937681400a6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2498f591eac727201c8b8937681400a6_JaffaCakes118
Size

48KB
MD5

2498f591eac727201c8b8937681400a6
SHA1

794f63498c162197054e2b0950481cab4364a389
SHA256

bbe3d8bafe176f6f8c67eedaac149c9509a969df1f4c1a89530f37ca0976508e
SHA512

468d2c12d307a8d28ebe5e64d7eade268cb6c1c32a39810677fae4a28f81bb45ad86fcfb5df00401d5ca86097aa84b14ec37e088d343a6a310324234eb285ce4
SSDEEP

768:nxwhpdk+VRW9kBYbEQ2x0QY6RIbIF3BF3INUF3G6noj3r/eK4YtQwXpOfV:Ekt9T2xHYEIbIRBRI+RG6or/eKE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2498f591eac727201c8b8937681400a6_JaffaCakes118

Files

2498f591eac727201c8b8937681400a6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9534fcd0f693009c88102eb0630b67fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

HlinkNavigateString

Sections

CODE
Size: 17KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE