343cb826a08ab9b54236b9f48716d626_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

343cb826a08ab9b54236b9f48716d626_JaffaCakes118
Size

68KB
MD5

343cb826a08ab9b54236b9f48716d626
SHA1

8e44ee237abedf5d901527a9840948ce5e46f103
SHA256

f631312f1942b1cf91d10603112a71b076e479f301e3f96df636326cbba9d728
SHA512

649b4da4e6e60b783a3c9db851abf19c546d15088801cbd65c646ddb2949fed538975cf87a9f8a1ab5c93510dadc5c9c12aaea97294022e02dc5e6f491921ce9
SSDEEP

768:lOgaY9OKdj0Nq8D+kDrJR32fsp54kFseWiYOpvCcOmT/Ut1z4ETl8hDC3xeureus:Qvd13n2A43peCc9Ythf8hD4cSZbta3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
343cb826a08ab9b54236b9f48716d626_JaffaCakes118

Files

343cb826a08ab9b54236b9f48716d626_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5ae92651d0333d2b2ecbca4a9049ced8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

wininet

InternetCloseHandle

shell32

ShellExecuteA

Sections

CODE
Size: 37KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE