318707ca017ef8e6b57e08d82d39e190_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

318707ca017ef8e6b57e08d82d39e190_JaffaCakes118
Size

606KB
MD5

318707ca017ef8e6b57e08d82d39e190
SHA1

b6db2592261f8517057ba53ecea24f796f4b437f
SHA256

37b2e1c5e09f799cbd1b4eba45f9d4c02d7f2bcf9b0ee946b224ee97fbb159fc
SHA512

36b2c4dd993da49233cc004843ac75fa8abed30a8cbe6eadc3a236ece4d801cec694c3ff634cd0c4522bdc41a915f37c215139fc25e64cb70d10e62e745e7595
SSDEEP

12288:9NAZXqZG96mLm+lzU6PPA+RRJGLy0NwXx2uQDpzNFmbIQ:9+79zLdlzUs620aX/IpzN2IQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
318707ca017ef8e6b57e08d82d39e190_JaffaCakes118

Files

318707ca017ef8e6b57e08d82d39e190_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0a8d8633d7aef09bf7770da0568f6bca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExW

user32

MessageBoxA

msimg32

GradientFill

gdi32

UnrealizeObject

version

VerQueryValueW

ole32

OleUninitialize

comctl32

InitializeFlatSB

msvcrt

memset

shell32

ShellExecuteExW

winspool.drv

OpenPrinterW

sqlite3

sqlite3_create_collation

Sections

.text
Size: 496KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.15bnbF
Size: 7B - Virtual size: 7B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kueSvg
Size: 43B - Virtual size: 43B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE