654a5e14d1132e48ebec29f76493bd56_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

654a5e14d1132e48ebec29f76493bd56_JaffaCakes118
Size

441KB
MD5

654a5e14d1132e48ebec29f76493bd56
SHA1

3445ca8cef7b66afd138c02f98181fadf635b354
SHA256

604c6a57f5267eec9f9381ca41edf3d7da66e12ad908fb02ee28d51fa399b51f
SHA512

5cc97a5a814195007eb0f7498f3063beb53b59d33e22bca7cce78fdaae6baa575b8e3418f2a5dd50e9f86e8e8f58370006986a0743ac3d6e7784c25028e9e98e
SSDEEP

6144:eLaZO1L8QsX3R9h6ZwyRIPb6lrzoMljymIp4Z0Z8WGLKdHXudpryZIYaQ+wdh0u5:eLBL8fjnbMMmIOk13uMKbpvoQGWk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
654a5e14d1132e48ebec29f76493bd56_JaffaCakes118

Files

654a5e14d1132e48ebec29f76493bd56_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

b833c8b9ef7c8f69ef4384881250a465

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 428KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE