78be3b995ee14e0b508a495088582013_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

78be3b995ee14e0b508a495088582013_JaffaCakes118
Size

408KB
MD5

78be3b995ee14e0b508a495088582013
SHA1

b74fc735650fa65aca400c79f80737030e8affd4
SHA256

196d853dbb780fc98b058162d991d2ab8140f6af49b8708465c33504d490c192
SHA512

cb34bcbd908ebae079ef2fdf35dfce886b12ef6f118dd4a1ac452ad4bb96a35e40f225fa5d7684ed9adddf2c252f3f4786f0f20e81e7e4c3cb00b7697f1c4d44
SSDEEP

12288:y2TeCurVrVNzv1UZVuvwhuFiQJp8oBWdbzh6z:yaeCurxVNzv1UmvwMX8o8bzW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78be3b995ee14e0b508a495088582013_JaffaCakes118

Files

78be3b995ee14e0b508a495088582013_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5ab75da712ae39addd3483750911a5fc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

CharNextA

advapi32

RegCloseKey

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

SaveDC

ole32

CoInitialize

comctl32

ImageList_Add

shell32

ShellExecuteA

winmm

PlaySound

ws2_32

inet_ntoa

hhctrl.ocx

HtmlHelpA

Sections

.LordFox
Size: - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.LordFox
Size: 394KB - Virtual size: 396KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adate
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE