2e9682f78089c29b62f371643e50c235_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2e9682f78089c29b62f371643e50c235_JaffaCakes118
Size

94KB
MD5

2e9682f78089c29b62f371643e50c235
SHA1

eefcf5e7762b9503bea050357f0d7ddbbc1a7f30
SHA256

47867b626c34ac8c5d9b9def67541c06d84edbca031c52282b4d16f9731586aa
SHA512

a80641edb4c4f93d8878270e659270bed1afbc0710c5c64cfe0a36cfe0217ff41ccf9acbdb2bf257c4b263dc00bc75f661c510d44c79c6b3f352c4fc35d7bfab
SSDEEP

1536:WHfqxakT9zh2dHNqF/8+Ar14QFn/3NCBl+AWwzGgx3+YUao7R0AipTMbahVc+M3H:W/qg89VbF/0r1h/d0HWwy83+t7R0XpI0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e9682f78089c29b62f371643e50c235_JaffaCakes118

Files

2e9682f78089c29b62f371643e50c235_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c42bf4107481f4960a34f220d5944482

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

shell32

ShellExecuteA

Sections

CODE
Size: 88KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE