41325f69869e6d2ec64ad02c8d6c9c01_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

41325f69869e6d2ec64ad02c8d6c9c01_JaffaCakes118
Size

20KB
MD5

41325f69869e6d2ec64ad02c8d6c9c01
SHA1

5b49abbe8b2da1d53c8cc800cfd2ea2759ba4057
SHA256

d2e4d37a6c07e50c5a626a1d110f44af51cc5d054aa0ea32a010d2d51f72dfa7
SHA512

09b0b37702ae0259caf004aafe7e4077ec37edf9fcdafdd6ce156b86c07b4ca9f5204d64df8d271095773df2d001ba0fdadbee044caa4287f9252dc290605d62
SSDEEP

384:kaAWo93lyzvTAUH0uJveGIAEFY7JPBkNCdKVcjy61SVY:kaAW+o7VRJvfIA17JPBkNyYcHEG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41325f69869e6d2ec64ad02c8d6c9c01_JaffaCakes118

Files

41325f69869e6d2ec64ad02c8d6c9c01_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cab5e624faa7992eae9f2903c70ae16a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetOpenEnumA

gdi32

GetStockObject

urlmon

URLDownloadToFileA

Sections

CODE
Size: 16KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE