405149333bc538f16db6ed1aeb5815a0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

405149333bc538f16db6ed1aeb5815a0_JaffaCakes118
Size

306KB
MD5

405149333bc538f16db6ed1aeb5815a0
SHA1

7076f47e70ee61e0d07a90484641b501afa3c5e6
SHA256

d22d8c7e4591d387d4ba1622b543ea0c06a9ec9525e5becae31ed2e2f1ecacfe
SHA512

e77abc1661259322ce664a7810bac947fda8669f979378cf9e72fb9abbb6b7d1d50640c5c4683ef2f46c5f7165c9644d52cd882e6b815b57bc2906d62837814d
SSDEEP

6144:UwCIV1ubzg4U1oqWCi0cBWn/tgYJUPke68OfMcL8ouGQoB8OrqGhqI+0Dugr:UwCITuBU1fWm/SY6kEOfLsZoB8O+GwIn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
405149333bc538f16db6ed1aeb5815a0_JaffaCakes118

Files

405149333bc538f16db6ed1aeb5815a0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9fa5d7c0df82105f2f437398f686e516

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetUserA

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

wininet

InternetReadFile

winmm

waveInUnprepareHeader

netapi32

Netbios

wsock32

WSACleanup

avicap32

capCreateCaptureWindowA

msvfw32

DrawDibDraw

urlmon

URLDownloadToFileA

ws2_32

gethostname

Sections

CODE
Size: 267KB - Virtual size: 776KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xiaohui
Size: 28B - Virtual size: 28B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ