312d9e8768f840a4b8fd26507c648071_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

312d9e8768f840a4b8fd26507c648071_JaffaCakes118
Size

408KB
MD5

312d9e8768f840a4b8fd26507c648071
SHA1

59901184190a8026120620f4d1ff677a5a2606e7
SHA256

cad7971521fd43d73667dcb4bf7682683ab557c25e526a3c07f3856ea9da5358
SHA512

bd761237510a70552a147fb3e16fa8b8c1975ea2abab2e2d05f3457b2aac5e31336a5284f55434f67babee5d43e103d6d9b8e10e3257c2162960cd6a63f4188f
SSDEEP

12288:PwTcR07mT8lLwyIk24Xb9PCugeKU5razl6C1iVyM:P3Y3I8hj0zl64

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
312d9e8768f840a4b8fd26507c648071_JaffaCakes118

Files

312d9e8768f840a4b8fd26507c648071_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d763060a6da95035bb4aefce43f0ae33

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

wininet

InternetGetConnectedState

wsock32

WSACleanup

Sections

CODE
Size: 362KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE