6a9800baba5fae161bc44181fe2006ff_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6a9800baba5fae161bc44181fe2006ff_JaffaCakes118
Size

238KB
MD5

6a9800baba5fae161bc44181fe2006ff
SHA1

44f494b944dc6bbf7c3e33b40e4f02ee7397ae90
SHA256

001c34fe4a509670c8800b3a8fb137cfa7f536896b9ddfbfd9c116b34fe3af13
SHA512

125b4d328f9d197db8d29cf0161d33ff19c730ac56f463785c0314f94e62214af6867e97d90ee5c3df7badf2f974bb6fb0fd67f7b8d95003a6c2f6c85b533c53
SSDEEP

6144:Hbi5/PtiuHViQOB/rKs6S4KbfWyfXVCQxFr6Op5r6D:HOH5OB/pwKbusFCcxV6D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a9800baba5fae161bc44181fe2006ff_JaffaCakes118

Files

6a9800baba5fae161bc44181fe2006ff_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8a8256941f642d7feba57cf5557a2d05

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
VirtualAlloc
Heap32First
Heap32Next
WriteFile
GetEnvironmentVariableW
Heap32ListFirst
Sleep

user32

PostMessageA
GetMessagePos
GetInputState

ole32

CoUninitialize
OleInitialize
CoInitialize
CoInitializeEx

advapi32

RegQueryValueExA

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE