6a687335c450953c752e982c40465d88_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6a687335c450953c752e982c40465d88_JaffaCakes118
Size

28KB
MD5

6a687335c450953c752e982c40465d88
SHA1

d482c959428ae133c45d58b9baea171e2dadce29
SHA256

16f4fcd3dad945c4bc4668691f4a493f9532ace6a1dbfb0320e03c6436230577
SHA512

f64eacdfe53c79ac9d3fd29b2736380596f60ac540b810f357576a2837b59d1b1a0d4711728e21e7e21bd226d031c3198375403b6beb9616b7951a8e144bea26
SSDEEP

768:qf8f+dF8oQuMQXbaEAW3euvcIiCN2vnyj2jM/Lv:qfUIFpQqb0W3euvcLCN6nyj2jM/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a687335c450953c752e982c40465d88_JaffaCakes118

Files

6a687335c450953c752e982c40465d88_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4c7c179f0127b28ee6f5bf78efbda5d0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

HlinkNavigateString

shell32

ShellExecuteA

Sections

CODE
Size: 22KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE