677882ea09570a833ba4e59aef1f6409_JaffaCakes118 | Triage

Sharing

General

Target

677882ea09570a833ba4e59aef1f6409_JaffaCakes118
Size

168KB
MD5

677882ea09570a833ba4e59aef1f6409
SHA1

282c7b463afcfd69149548afc9f1d1128dd8fb25
SHA256

ceeae30cc1c90e3985492f4f0b472f8fe102170d83797868082bdc7282db6362
SHA512

07d8beb4d5ed4464b55ac6fcc11b08df6034e167a6cefd4c5af0050a0195641adaad55e1791d9d89f980d6c4749b7e2b3197a7012bbece8107717f64a50dc0ff
SSDEEP

3072:VUmvmgxKUquU6c3OsJkkZxDkK6j2DTYHKw8QZiDMfl6reNEfNf+4:VHKUo3xk8x4KvkHK75D+GfJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
677882ea09570a833ba4e59aef1f6409_JaffaCakes118

Files

677882ea09570a833ba4e59aef1f6409_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9685b235eafa107280ef6bfebadf2237

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
MessageBoxA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile

advapi32

RegQueryValueExA

oleaut32

SysFreeString

wininet

InternetReadFile

Sections

.text
Size: 21KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE