6f2764ab55f0f3a87a2a25ac64db98ed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6f2764ab55f0f3a87a2a25ac64db98ed_JaffaCakes118
Size

1.3MB
MD5

6f2764ab55f0f3a87a2a25ac64db98ed
SHA1

915c86b43378d86143d062576ee0e66ef1e02795
SHA256

4cc75ef763dc1c8c8e6f5876b4d880c5a61b972f56ef053419b7a7231b099b8c
SHA512

a829262376bb81c18cadaceee45238c6aec9c3a8545a45b798bd84970c3dc438cc39f2f34764c4d68eb395f656c75ef1a6f3cb417e4eaa2020605463eb028ebe
SSDEEP

24576:bjYRpv+SrHnQOdJdWvRcYb99bkbnTLOzLFWQY+qO8bAsKRUEnaDytwCb4hG:bURsSLntJYp9I3LmLoQY+qpkRdmytXoG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Fileupdate.exe

Files

6f2764ab55f0f3a87a2a25ac64db98ed_JaffaCakes118
.rar
Fileupdate.exe
.exe windows:4 windows x86 arch:x86

eab4ae5f4bdfa1db6130a6d5dccb6071

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

wininet

HttpAddRequestHeadersA

advapi32

RegCloseKey

version

GetFileVersionInfoA

wsock32

WSACleanup

winspool.drv

ClosePrinter

comctl32

ImageList_Add

comdlg32

ChooseColorA

gdi32

BitBlt

shell32

SHBrowseForFolderA

user32

ActivateKeyboardLayout

winmm

PlaySoundA

imm32

ImmGetContext

ole32

CLSIDFromProgID

oleaut32

GetActiveObject

oledlg

ord3

Sections

.text
Size: 1.3MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
新云软件.url
.url
软件介绍.txt