889c4d9103f370b3236aa6d71c24b394_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

889c4d9103f370b3236aa6d71c24b394_JaffaCakes118
Size

51KB
MD5

889c4d9103f370b3236aa6d71c24b394
SHA1

b454137eecb776d23b77b28377d19fa81317b7e4
SHA256

72004587e83d51f1d2580a754aa517b067c00ed33ee09b0ba6eb5391d45d85ea
SHA512

b4afdd07c3ce43214dc1df087543026e36211c5900c467e10e91b9c798bf35d18147d62954adaf31c75cc2454010070d51743df09b8548fdff7031d87b689a3a
SSDEEP

768:LwTukTPTBKhmGjam9HczJqoBRV+CsGlsdnBqhmef1hXLssk4fBf0YU7sw8XhJyIW:LKNTPmTczJZbXPsdVI1lLh1YsQIdo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
889c4d9103f370b3236aa6d71c24b394_JaffaCakes118

Files

889c4d9103f370b3236aa6d71c24b394_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29d4d9a4e535bff721362e89820bef9e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 39KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE