691b48c2adee4ba18571355f31921081_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

691b48c2adee4ba18571355f31921081_JaffaCakes118
Size

301KB
MD5

691b48c2adee4ba18571355f31921081
SHA1

a8160920d92a54c7546c962122011a164209c31d
SHA256

603b334fc183c479d9c8ff94251800e29af3cb4dd8d821e2c6308b4bff90ec1d
SHA512

f948cc04ac0b80068e428fbb7301ca4db2ca8d7dc489727194134b49c5be026b7db90a5660a92d880cb3c65d82016a5b0b98b3af474dc52f8e3b3058920b82d8
SSDEEP

6144:7J5gXvSE0W/KB82POcwwkxPPH81lQYOnQI7eLvnmQvMYuPO1xzULMo:UXvS9FGxHPE1lQGT7v/HXop

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
691b48c2adee4ba18571355f31921081_JaffaCakes118

Files

691b48c2adee4ba18571355f31921081_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c42bf4107481f4960a34f220d5944482

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

shell32

ShellExecuteA

Sections

CODE
Size: 294KB - Virtual size: 800KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE