4801e2abdc5094608b557951acdfb22f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4801e2abdc5094608b557951acdfb22f_JaffaCakes118
Size

5.4MB
MD5

4801e2abdc5094608b557951acdfb22f
SHA1

04bdf7ba828104881d33a243f9a2866a9833c29a
SHA256

f520bfe8297e6e3f1e3d9f98f7a051d9d9d23b2c4bcb81a34aa95744c7f8a65b
SHA512

9afe2983a2e2d4fe014e4122d5f3fc39ca9a8dcf3414f3f2740ff0e9336c64a7df82125b164d6c53f67b276f36a7371870770851596b45f21814e31d1a25b52e
SSDEEP

98304:cRiScd5vwyur6w8IoPdPyqsUmlcuC9ptAplEebO5CD6b1+Q9GVZcz8UbQZipp1vM:miScLvwvmw8LQliuCVE6eKgKr9G/czsP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4801e2abdc5094608b557951acdfb22f_JaffaCakes118

Files

4801e2abdc5094608b557951acdfb22f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e4343f4719d618476ebdc59eafb94faf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA
DdeCmpStringHandles

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep
SetNamedPipeHandleState

advapi32

RegQueryValueExA
RegSetValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

shell32

SHFileOperationA

wsock32

connect

Sections

.text
Size: 21KB - Virtual size: 16.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE