418a12ad7291d329316dc5ccc13cf683_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

418a12ad7291d329316dc5ccc13cf683_JaffaCakes118
Size

3.3MB
MD5

418a12ad7291d329316dc5ccc13cf683
SHA1

941afcabe7399f895a418f3eb1370da29546b0b8
SHA256

14ace35e97b6fd2a445e6ba2155439e4c534fb55f33149e065fe4ed05d80c003
SHA512

f18457a9d499b4ab1ac063a483ad6ba7f97eb978f28495b3f76a1eca6903d0207c1fd37e4882cb50adc5a94ff4d1f7f6631e9483f5e66bf22ed456e76a6063c6
SSDEEP

49152:XHoa2Tz9CvWIPTnG/xViCsBkRlGHmT6EFGIC9z6G1lUV64PTyhFX64sZRrS1yqwG:XX2TzqW8nG/fKHme4YRpnh1t+hqpI/j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
418a12ad7291d329316dc5ccc13cf683_JaffaCakes118

Files

418a12ad7291d329316dc5ccc13cf683_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f4089fe30323b0998ab170aa1ab245a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

Sections

CODE
Size: 3.3MB - Virtual size: 16.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE