6f6516ec02c5224aa2512077718f6545_JaffaCakes118 | Triage

Sharing

General

Target

6f6516ec02c5224aa2512077718f6545_JaffaCakes118
Size

169KB
MD5

6f6516ec02c5224aa2512077718f6545
SHA1

0a44041b823ae68e8420a58fff2beb80cbd14966
SHA256

7e0f298601450b9d0d6d527ee6a0901213d256153ba2e4e1d704ffdd401f00de
SHA512

9253c000294eb78662c11c52461232352453d67dc495bab7ac698dbce081c15b2733906d37e3d8f4ac3cd3a69a44140920cd66a41d31d9c22937f62dab88167d
SSDEEP

3072:ll156yqSGEWWxh8xgD06ASBPhS04tCQroLGF6aaayeI3sZsWgohX7T9Eu9k:l7qSGIxh8xs06ASQroQaae3sKuNEu9k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f6516ec02c5224aa2512077718f6545_JaffaCakes118

Files

6f6516ec02c5224aa2512077718f6545_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a44d45584dcf9ac6a7643097738df895

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
MessageBoxA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

shell32

ShellExecuteA

Sections

.text
Size: 23KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE