7187f8f3e7c0ad06d08ae40e4b1096cc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7187f8f3e7c0ad06d08ae40e4b1096cc_JaffaCakes118
Size

481KB
MD5

7187f8f3e7c0ad06d08ae40e4b1096cc
SHA1

cbda49334b2ae91de11126033ef07fab11b5428c
SHA256

0a44224e0dd3f7e1da0d0d49c4bec767481a200a5bc2c351655bf26595eeca66
SHA512

f5fbfa7cf358fb10e7238787588525265b11ae2c664aefed7da129ea1522d9a851d4cb45416d76154449c8c13911ebef975379eaddc0870e2cc2c4654b7abf8c
SSDEEP

12288:eYfbsxpdrCGmA0Lh1C/KDMnb8WCfCdXAyF0Hz9hbn:eYzsbdVQh0/KJB+Qy6pd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7187f8f3e7c0ad06d08ae40e4b1096cc_JaffaCakes118

Files

7187f8f3e7c0ad06d08ae40e4b1096cc_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

b833c8b9ef7c8f69ef4384881250a465

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 470KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE