30470c75fd09f8d3d3965350a4300f43_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30470c75fd09f8d3d3965350a4300f43_JaffaCakes118
Size

545KB
MD5

30470c75fd09f8d3d3965350a4300f43
SHA1

36a884f5619eae521e519f6a3f74dcc931a9b2e5
SHA256

00553fa26d24e165db8498f4401121039b4d427479d578e0e83ff7e281623142
SHA512

a9c31e66588739cc2efa0650c9c1e55519f54f3812e289ca5414730753bfb472583c4fee9f3aa6e3ca0c43720997951ef885d353bfa30cd0f6c543ba6d3bfe82
SSDEEP

12288:q3aJk3U8oFbBn6AHuEqF5Q/ytyWgyInBqNo1MGzqqTjhrAjBXb8mMkJ:q3OkEdxnWo1MGVjhCJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30470c75fd09f8d3d3965350a4300f43_JaffaCakes118

Files

30470c75fd09f8d3d3965350a4300f43_JaffaCakes118
.exe windows:4 windows x86 arch:x86

913eeb3eadd35045e8e05468cbeb18ac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA
GetKeyboardType
CreateWindowExA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
GetModuleFileNameA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep
ord1

advapi32

RegQueryValueExA
RegSetValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

Sections

.text
Size: 45KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE