30446b292f488f500e8ce0a7bc996150_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30446b292f488f500e8ce0a7bc996150_JaffaCakes118
Size

373KB
MD5

30446b292f488f500e8ce0a7bc996150
SHA1

fdc126d6de510a109ea03309903260ad36d02477
SHA256

1f8a207a509f45e3ed262d804bf50ad2317a77fe9f59155b6bce0c94cb482d32
SHA512

7c6aff7c73f6f638688c6e8bbc3a02f52c01df2e024cbfaf1e91a9e88e94149f69eb031285e9cff61a19a996f2214e94bff0000e52e8375913cd8994294282c2
SSDEEP

6144:34hxy99lUR38RQQ4PtiPovCucr8vFbWFtbv/k5eLOveW5ZlwPtvluh9uAeGRLDCu:3gq96MRQYKCAvFbwtjiuO75/wquG+W7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30446b292f488f500e8ce0a7bc996150_JaffaCakes118

Files

30446b292f488f500e8ce0a7bc996150_JaffaCakes118
.exe windows:4 windows x86 arch:x86

169b3bf056755bc29098ad025a9e735c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep
ord1

advapi32

RegQueryValueExA
RegSetValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

urlmon

URLDownloadToFileA

Sections

.text
Size: 28KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE