6479d6f4eb046f5d4cfffc36b7649c93_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6479d6f4eb046f5d4cfffc36b7649c93_JaffaCakes118
Size

72KB
MD5

6479d6f4eb046f5d4cfffc36b7649c93
SHA1

f83fad551cbaaab1f53d32978f69a5d0cbbe5edd
SHA256

3ecd3a327f54677cbb22f16a8d1ed0a4305cdb3d55ac62e9e6cd390ed5f30298
SHA512

291bc51e82090a2a26ce45f647ef9456cb92cfef0e9ed6d2d5690a2b44fe5bf886646f63ddcd663781c7f5c2cf8a064973873a5907f5378868582ddeef97c5ff
SSDEEP

1536:QjafKMlofuI59Mj81xb/QPCovD8C61OvElaOBotvoT:QjaRquI59I81p6VvACkHaqkwT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6479d6f4eb046f5d4cfffc36b7649c93_JaffaCakes118

Files

6479d6f4eb046f5d4cfffc36b7649c93_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ebd832edfcba8aaf56fc0410e66df990

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

shlwapi

PathFileExistsA

Sections

CODE
Size: 66KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE