315cd2dba3b6423869972451f08eb9f0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

315cd2dba3b6423869972451f08eb9f0_JaffaCakes118
Size

125KB
MD5

315cd2dba3b6423869972451f08eb9f0
SHA1

76657b137b27173bb09ebfa4aa9fa7c1a14e6f9f
SHA256

c0a42983a4830a3e1d9916050b02b931462e2aed0aa165a3740efe2bc2a930b5
SHA512

79e58dbf3ee9c8298942dab6c0455f0b8ab639daa4dfb4cc77dd8455ac60859d0f9e13034a1bdb2a16bfa99bcccf6ca59c28b8b422aaf447b0dbfa1c8d9c3e40
SSDEEP

1536:32RmfZXoK5/yHCfPtkUco6iTf09kV//IWojHIQlsLKpYsnr/XZaPG8i2TTE9SxwC:GYfZ4THmkOlwNZ40nr/XZaOAQtCE2V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
315cd2dba3b6423869972451f08eb9f0_JaffaCakes118

Files

315cd2dba3b6423869972451f08eb9f0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

86274a3da7672c41f85015674fc5c9f5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

gdi32

TextOutA

winmm

waveOutGetPosition

shell32

SHGetPathFromIDListA

Sections

CODE
Size: 115KB - Virtual size: 488KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE