8e42cb8367a2513c4858e2ef16db96f4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e42cb8367a2513c4858e2ef16db96f4_JaffaCakes118
Size

1004KB
MD5

8e42cb8367a2513c4858e2ef16db96f4
SHA1

ce3b47ec01e28fb992a3389784a6daf34ee8d982
SHA256

0cab427b461227b0e70b593e0e97299810d2f78a2a57c97b4248daef96aa82d9
SHA512

2dd05fc86d172a173e315b8e75fddfdd909999bf28e4278adc11ca6dd290710860b5de5cf7ccf4b64b3adce8cd8b704301b4efb99aac10fe10523b0dd65d94d0
SSDEEP

24576:srWprQ5gdsKstHMOE7ggWzGM2Z/WrdZg/MTko:sKGgWRMn7ggMGL5ubOM3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/crack/wintasks.exe

Files

8e42cb8367a2513c4858e2ef16db96f4_JaffaCakes118
.rar
crack/arn.reg
crack/wintasks.exe
.exe windows:4 windows x86 arch:x86

3c672232a1b0b6d15958908a0aff9b51

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

advapi32

GetUserNameA

lz32

GetExpandedNameA

mpr

WNetAddConnection2A

version

GetFileVersionInfoA

winspool.drv

ClosePrinter

comctl32

ImageList_Add

comdlg32

GetOpenFileNameA

gdi32

BitBlt

shell32

ExtractIconA

user32

ActivateKeyboardLayout

winmm

timeGetTime

ole32

CoCreateInstance

oleaut32

GetActiveObject

olepro32

ord251

wininet

FtpCreateDirectoryA

Sections

.text
Size: 991KB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
crack/下载说明.htm
.html .js polyglot
下载说明.htm
.html .js polyglot