2c86ea503670d5e3eb7ec2aebc19db1d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2c86ea503670d5e3eb7ec2aebc19db1d_JaffaCakes118
Size

6.3MB
MD5

2c86ea503670d5e3eb7ec2aebc19db1d
SHA1

68abc1ccd8971b499fb850ff9ed49ed10713e0a8
SHA256

8f4d84da40c9128248940a7e192d638a7a4617956eea7f4190bed07cb02b78e6
SHA512

b67eda605a33aa0cbfad1c925eb1a71bb5accfca262695915167c7af5360be5a4f68c6bfc419db629b301fade63d78e064b4f07e3134379c43a94ab5063ca03b
SSDEEP

196608:EvWm2osmccBTHnJCdEf//Cgg5kYEJVS8g:KUlcBTHyc/LQ4S8g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c86ea503670d5e3eb7ec2aebc19db1d_JaffaCakes118

Files

2c86ea503670d5e3eb7ec2aebc19db1d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7e0f429479b97ceea07da9aa1ddfa8c4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrlenW
Sleep
MulDiv

advapi32

RegQueryValueExA
ReportEventA
StartServiceA

oleaut32

SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo

version

VerQueryValueA

gdi32

UnrealizeObject
GetRandomRgn

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

winspool.drv

OpenPrinterA

shell32

Shell_NotifyIconA
SHGetSpecialFolderLocation

wininet

InternetGetConnectedState

comdlg32

ChooseFontA

winmm

timeGetTime

netapi32

Netbios

wsock32

WSACleanup

Sections

.text
Size: 29KB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE