29f8ae6d5b151418a520cddd7826920c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29f8ae6d5b151418a520cddd7826920c_JaffaCakes118
Size

294KB
MD5

29f8ae6d5b151418a520cddd7826920c
SHA1

4096daac63b0628caa76c4390e166175869eafcf
SHA256

7a2d15663c50d7ecd873adbf2a49a4a46feea659148c05ec6b7b73f3f8e89eb7
SHA512

9535fc2d62a1fe1dcefc48f8bae7618d404c95fe906b924b8aa1d6d0ab7988aeae7f6d78f4da6174ccdf27ce765e8429934e3a2499a1db9813cdd670c571163a
SSDEEP

6144:1jblDWq4wNPSaPCzJLFj/c80wbWYVJ4eJCl8H:hJgNFwJqa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29f8ae6d5b151418a520cddd7826920c_JaffaCakes118

Files

29f8ae6d5b151418a520cddd7826920c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cfef8918eb06fe9cd292b786655a4658

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

Sections

.edata
Size: 215KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE