628722e5ab6da14ba958801f49b719cf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

628722e5ab6da14ba958801f49b719cf_JaffaCakes118
Size

155KB
MD5

628722e5ab6da14ba958801f49b719cf
SHA1

32bc416ad206f2c6a15a078a63edacfab892a39e
SHA256

d04b68842659979382e47216f29a4455480588d718fb2624c3e60daaeedc21af
SHA512

1b4fb4cc94faf080a0dc623679a71de6d7aa2fabaa31acbf177e0acdc28f5a6c2c8e82c2aaf1b4f7ae0f41985db9576a157f9b7e33b5da927c519f9232c43d75
SSDEEP

3072:eYeQZ7D9kaRqPBFYGe4hKjLlT836hQJLCpQr0O6iduOHWOdFS+39Fd:eM7xPSP/e4hKjL6dpCqLJWOdt39L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
628722e5ab6da14ba958801f49b719cf_JaffaCakes118

Files

628722e5ab6da14ba958801f49b719cf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d2bbddb8c010773f04c2d9dd29668462

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

Sections

CODE
Size: 132KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE