8c196f0a39e9b196dd119e9057e84e01_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8c196f0a39e9b196dd119e9057e84e01_JaffaCakes118
Size

92KB
MD5

8c196f0a39e9b196dd119e9057e84e01
SHA1

9f282b66b065d93c074a946f3fc0762b24380d3b
SHA256

d9afa4123673f62f0530451f3742662b9bff7b2a9afa0ea0dd4556ad90ff0bd1
SHA512

14d8edcc83982ecba03efd65fd187a311d78f509c3c4d02874353686c4a823200401be218cfa82f4c17a2a67c20284ca44c99a3ddd5ebb9c834d05e5545d6a24
SSDEEP

1536:gLeEuL6jE8j3Y1iAPu+Y1UFIgQJefWuYX1MIwhDvlRr9mbxk3+BhLhsiZVGN6qLG:IeEu21j3uu+Y1UFeJeutXS5xl19K9dBp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c196f0a39e9b196dd119e9057e84e01_JaffaCakes118

Files

8c196f0a39e9b196dd119e9057e84e01_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c42bf4107481f4960a34f220d5944482

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

shell32

ShellExecuteA

Sections

CODE
Size: 87KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE