3b99a33480e14d320759eb957cb0bcbf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b99a33480e14d320759eb957cb0bcbf_JaffaCakes118
Size

176KB
MD5

3b99a33480e14d320759eb957cb0bcbf
SHA1

13979bf42668a003520d7f113342241adc0a08c8
SHA256

49db7e1417b6cc4c7189728efbcbd870a868ecc00d6a44da68a6e9df13fa0316
SHA512

671c633a2080fa3dfa4af541a2f55d1b614ae5d91e6f789137b5aaeb3fc40e2bbd40eb68b3d7b739e5def68aec8b8110d7657773cc5c97b2c7a69be978a748cd
SSDEEP

3072:cTyP544wRAFd9khOX1JxnPc9pGbK027/YGMocKdjDx8hvkM0p5kYf7rjnSpo:/Pa4wyPOOjtMpGbMQGPzlDx8hMM0pOK2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b99a33480e14d320759eb957cb0bcbf_JaffaCakes118

Files

3b99a33480e14d320759eb957cb0bcbf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c7489ad741f8e77e9f4589921b05026b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

LresultFromObject
CreateStdAccessibleObject

ole32

StringFromIID
CoTaskMemFree
ProgIDFromCLSID
StringFromCLSID

advapi32

RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyA
RegSetValueExA

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

kernel32

VirtualQueryEx
LocalAlloc
lstrlenA
RaiseException
EnumResourceNamesA
CreateProcessA
WideCharToMultiByte
MultiByteToWideChar
GetCPInfoExA
GetSystemTimeAsFileTime
InterlockedExchange

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ