9534958294465f309ea1e4ca48dbcdaa_JaffaCakes118 | Triage

Sharing

General

Target

9534958294465f309ea1e4ca48dbcdaa_JaffaCakes118
Size

88KB
MD5

9534958294465f309ea1e4ca48dbcdaa
SHA1

166bdb95dd458fcd818a1f39fa1ab5e5c9647515
SHA256

3d56499fc792a6412a5a6a05577e920fcdb2775a3da406cb1cf3abfbc1759958
SHA512

193149bd3a6bd3bb7fbdc7a1f229d98ce7a2c68c1387fdab8acc4aeab4df1d202e0bf51e8aefef7c32c6bff3a6fe3d5acde30b2d12bdc7bad97a238316f5a26c
SSDEEP

1536:pHLnHQGB9lOlDM8uC3gohppoFCnbry13BlogpkRuBmOuTg6XR6Pf69eq6yPuw:pHDHQSyO0wohAeHkxlobugE6XKfceq6O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9534958294465f309ea1e4ca48dbcdaa_JaffaCakes118

Files

9534958294465f309ea1e4ca48dbcdaa_JaffaCakes118
.exe windows:1 windows x86 arch:x86

a846bd3f6fc8cf75da827072bbfbea11

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

ntdll

RtlDecompressBuffer

Sections

.text
Size: 73KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE