37c0588092321917a32e869acea1cde1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37c0588092321917a32e869acea1cde1_JaffaCakes118
Size

3.9MB
MD5

37c0588092321917a32e869acea1cde1
SHA1

c793df4074c5e7805722fc80fbcc722512e649ec
SHA256

050b4a527d079c5a22072955725e9399a255515789c3f6b747da3d49f2b93663
SHA512

08cabd8f095618f04af8f16f7e7babcc0c3a9899aacac13095467fb89c2a369ac857e3800ae39ee266decfe834f3c04cc0c1faf7b6466e2b324a45385328d2bc
SSDEEP

98304:EknVshJ3rROX0MKNrGP+tevBa+Wi/PkohBcf38ddW8OdGjBeD:EknWhhrR8RtvIRNBIW87kD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37c0588092321917a32e869acea1cde1_JaffaCakes118

Files

37c0588092321917a32e869acea1cde1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

37ad55bbabdb5ac07ba2b40b25ef6a7c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA
DdeCmpStringHandles
ExitWindowsEx

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep

advapi32

RegQueryValueExA
RegSetValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CoUninitialize

comctl32

ImageList_SetIconSize

Sections

.text
Size: 30KB - Virtual size: 8.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE