6468143de4d1c28db367d4618d0c1a79_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6468143de4d1c28db367d4618d0c1a79_JaffaCakes118
Size

66KB
MD5

6468143de4d1c28db367d4618d0c1a79
SHA1

3a13ce3c40ff29eafa685f4ee6886603af11edf0
SHA256

aef5d5f1160a5f5f18c41f359f1c782d190b857e83487310d521072e921dc288
SHA512

0153b04da04cb982e5a24e5e71278a2634118214cebfd665129f2d9545b83c8c96b4f23fcd48b42286b42386fc1fe1984a7c0499ad01131b6694654fc3b4ef8e
SSDEEP

1536:0q7YZTXt2pxBwOaRQ48wP2Zd7AcilgSVZTxM2:b7Yz+BgZ8Oc7ArlgSjdM2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6468143de4d1c28db367d4618d0c1a79_JaffaCakes118

Files

6468143de4d1c28db367d4618d0c1a79_JaffaCakes118
.exe windows:4 windows x86 arch:x86

987ff2c070aa2519b09e54f56a8883bf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

urlmon

URLDownloadToFileA

advapi32

RegCloseKey

gdi32

GetDeviceCaps

shell32

ShellExecuteA

user32

CharNextA

oleaut32

SysFreeString

Sections

.text
Size: 43KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE