4d8c1034412db42ae48ee876209ff382_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d8c1034412db42ae48ee876209ff382_JaffaCakes118
Size

332KB
MD5

4d8c1034412db42ae48ee876209ff382
SHA1

34dd521b172468cb2bfbc67d07e40ad2ac45389a
SHA256

91163e67679c344c2c87d9e0ea9005b8bc530c090f358fd103193fab2a228483
SHA512

11e670865a36b247dd20a3c82bba64d814b1d5124ac0ff86e849f01736fed0016f5281e8e25e24747d8d17d59d7b19a7efdeb02e948ac85e063b95081e74eff8
SSDEEP

6144:zdj6UTIDAfilGOf1aoFD/lthYCdj6UTIDAfilGOf1aoFD/lthY:5VTbfvOlxjPVTbfvOlxj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d8c1034412db42ae48ee876209ff382_JaffaCakes118

Files

4d8c1034412db42ae48ee876209ff382_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c42bf4107481f4960a34f220d5944482

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

shell32

ShellExecuteA

Sections

CODE
Size: 162KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE