3ab9923fc17aa383b5c571de69edb043_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3ab9923fc17aa383b5c571de69edb043_JaffaCakes118
Size

254KB
MD5

3ab9923fc17aa383b5c571de69edb043
SHA1

9b39b472cef0b9222043edef35a11840d511fe39
SHA256

2b46df669adfc85df7c2cee3a0288fcbf2bdca6069ddc2e94bfd71e7b8d71282
SHA512

498824283d2059a498880f8e71d33e2721ca41ae7e60a05220575939ce501e5972d66c7a1c39b031d51eee01e452b9a52cbff4e95686a01122e20e8bf2273b7d
SSDEEP

6144:xO+VntRNEFBxhchHcsKJHs9kxt5TxW8c/dpP:xOYNEFB0MJM+azP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SyncExp.exe

Files

3ab9923fc17aa383b5c571de69edb043_JaffaCakes118
.rar
SyncExp.cfg
SyncExp.exe
.exe windows:1 windows x86 arch:x86

65478b422072205b60a46776982959d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

VariantChangeTypeEx

mpr

WNetCancelConnection2A

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CoUninitialize

comctl32

LBItemFromPt

shell32

Shell_NotifyIconA

comdlg32

GetOpenFileNameA

winmm

timeSetEvent

Sections

CODE
Size: 245KB - Virtual size: 704KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
readme.txt
下载说明.htm
.html .js polyglot