28d9f5a9bab0fe0afaaff4a3491b46cd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28d9f5a9bab0fe0afaaff4a3491b46cd_JaffaCakes118
Size

45KB
MD5

28d9f5a9bab0fe0afaaff4a3491b46cd
SHA1

020b8db3c9576b3f114cccfbe8fae09dbdb4f7b2
SHA256

0ee77cb40efca36583d2aafe42eb98008ae110f14307d70d7363d1db7ec2f25f
SHA512

28babfa5c4d49ad5da86f52b5d6b0472c512284ea740002d9300f985b16cc21b4d463a40210c84767af4a7b545344eddd7d4d15e9e5e343defb8c23380dd4399
SSDEEP

768:3L3i0QJ9/CmSm3UJHfsAIXjQgKPEbxaDFHnxhms8y9kWklzY:uljbSGHBxaDRnxhms86kpG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28d9f5a9bab0fe0afaaff4a3491b46cd_JaffaCakes118

Files

28d9f5a9bab0fe0afaaff4a3491b46cd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

acb329246d9827cd008494718ad202df

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

shell32

ShellExecuteA

Sections

.text
Size: 40KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE